From 81547195920d2d7c951f20ccf892296d87217446 Mon Sep 17 00:00:00 2001 From: Rhys Sullivan Date: Sat, 30 May 2026 14:03:20 -0700 Subject: [PATCH 01/31] Unify cloud, self-host, and local apps onto one provider-pluggable architecture Collapse the three product entry points onto a single composition front-door, ExecutorApp.make, so each app is one legible file that differs only by the Layers it injects. Shared provider seams (identity, account, db, engine, mcp, plugins, errorCapture) live in the core/host packages; app-only surface (routes, services like billing) is passed as extensions the core never names. - ExecutorApp.make facade in @executor-js/api/server; cloud/self-host/local each express their whole scenario as one make() call. - IdentityProvider is one neutral seam with WorkOS and Better Auth as two impls (no forked tag, no dead placeholder); failures map to a shared Unauthorized | NoOrganization | Unavailable set. - Cloud MCP dissolved into one mcp/ folder (auth, telemetry, oauth-metadata, jwt, mount, session-durable-object); no MCP files at src/ root. - Self-host and local composition roots flattened to named providers; production builders are unconditional (test apps use a test helper). - libSQL replaces bun:sqlite/better-sqlite3 for self-host/local/sdk-test; per-connection PRAGMAs; root catalog declares @libsql/client + kysely-libsql. - One noun per concept (Principal), org/organization normalized, filenames match exports; billing (Autumn) no longer appears in any @executor-js/* package. - Self-host container: multi-stage Dockerfile + .dockerignore, serves the built SPA + API + /mcp + /api/auth under one Bun process. --- .dockerignore | 10 + apps/cloud/src/account/account-api.ts | 113 +++ .../account/workos-account-service.test.ts | 192 +++++ .../src/account/workos-account-service.ts | 317 +++++++ apps/cloud/src/api.request-scope.node.test.ts | 3 +- apps/cloud/src/api.test.ts | 5 +- apps/cloud/src/api.ts | 5 - apps/cloud/src/api/autumn.ts | 8 +- apps/cloud/src/api/cloud-plugins.ts | 2 +- apps/cloud/src/api/core-shared-services.ts | 43 +- apps/cloud/src/api/docs.ts | 2 +- apps/cloud/src/api/execution-stack-metered.ts | 54 ++ apps/cloud/src/api/extension-routes.ts | 98 +++ apps/cloud/src/api/layers.ts | 88 +- .../api/protected-api-key-auth.node.test.ts | 25 +- apps/cloud/src/api/protected-layers.ts | 68 -- apps/cloud/src/api/protected.test.ts | 8 +- apps/cloud/src/api/protected.ts | 281 +++--- apps/cloud/src/api/router.ts | 14 +- apps/cloud/src/app.ts | 139 +++ apps/cloud/src/auth/api-key-errors.ts | 7 - apps/cloud/src/auth/api-keys.node.test.ts | 12 +- apps/cloud/src/auth/api-keys.test-layer.ts | 2 +- apps/cloud/src/auth/api-keys.ts | 18 +- apps/cloud/src/auth/api.ts | 53 +- apps/cloud/src/auth/authorize-organization.ts | 37 - apps/cloud/src/auth/bearer.ts | 9 + apps/cloud/src/auth/context.ts | 3 - apps/cloud/src/auth/errors.ts | 6 + apps/cloud/src/auth/handlers.node.test.ts | 16 +- apps/cloud/src/auth/handlers.ts | 85 +- apps/cloud/src/auth/middleware-live.ts | 41 +- apps/cloud/src/auth/middleware.ts | 73 +- apps/cloud/src/auth/organization-limits.ts | 37 - apps/cloud/src/auth/organization.ts | 74 ++ apps/cloud/src/auth/resolve-organization.ts | 28 - apps/cloud/src/auth/workos-auth-provider.ts | 224 +++++ apps/cloud/src/auth/workos.test-layer.ts | 10 +- apps/cloud/src/auth/workos.ts | 12 +- apps/cloud/src/edge/index.ts | 10 + apps/cloud/src/edge/marketing.ts | 63 ++ apps/cloud/src/edge/posthog.ts | 35 + apps/cloud/src/{ => edge}/sentry-tunnel.ts | 23 + apps/cloud/src/env-augment.d.ts | 4 + apps/cloud/src/mcp-auth.node.test.ts | 2 +- apps/cloud/src/mcp-flow.test.ts | 94 +- apps/cloud/src/mcp-miniflare.e2e.node.test.ts | 69 +- apps/cloud/src/mcp-session.e2e.node.test.ts | 8 +- apps/cloud/src/mcp.ts | 815 ------------------ apps/cloud/src/mcp/auth-provider.ts | 212 +++++ apps/cloud/src/mcp/auth.ts | 213 +++++ apps/cloud/src/mcp/do-headers.ts | 110 +++ apps/cloud/src/mcp/index.ts | 25 + apps/cloud/src/{mcp-auth.ts => mcp/jwt.ts} | 10 + apps/cloud/src/mcp/mount.ts | 101 +++ apps/cloud/src/mcp/oauth-metadata.ts | 32 + apps/cloud/src/mcp/reporter.ts | 24 + apps/cloud/src/mcp/responses.ts | 35 +- .../session-durable-object.ts} | 56 +- apps/cloud/src/mcp/session-store.ts | 168 ++++ apps/cloud/src/mcp/telemetry.ts | 221 +++++ apps/cloud/src/org/api.ts | 118 +-- apps/cloud/src/org/compose.ts | 6 - apps/cloud/src/org/handlers.test.ts | 270 ++---- apps/cloud/src/org/handlers.ts | 223 +---- apps/cloud/src/org/member-limits.ts | 28 - apps/cloud/src/routes/api-keys.tsx | 270 +----- apps/cloud/src/routes/org.tsx | 731 +++------------- .../src/secrets-isolation.e2e.node.test.ts | 36 +- apps/cloud/src/server.ts | 2 +- .../services/__test-harness__/api-harness.ts | 86 +- apps/cloud/src/services/autumn-plans.ts | 74 ++ apps/cloud/src/services/db.test.ts | 8 +- apps/cloud/src/services/execution-stack.ts | 138 ++- apps/cloud/src/services/executor.ts | 102 --- apps/cloud/src/services/fuma.ts | 66 +- .../cloud/src/services/mcp-oauth.node.test.ts | 22 +- .../member-limits.node.test.ts | 2 +- .../organization-limits.node.test.ts | 2 +- .../src/services/sources-api.node.test.ts | 62 +- apps/cloud/src/services/telemetry.ts | 2 +- apps/cloud/src/start.ts | 158 +--- apps/cloud/src/test-bearer.ts | 2 +- apps/cloud/src/test-worker.ts | 47 +- apps/cloud/src/web/api-key-atoms.ts | 9 - apps/cloud/src/web/auth.tsx | 106 +-- .../src/web/components/org-menu-slot.tsx | 183 ++++ .../cloud/src/web/components/support-slot.tsx | 56 ++ apps/cloud/src/web/org-atoms.ts | 23 +- apps/cloud/src/web/shell.tsx | 595 +------------ apps/cloud/test-stubs/tanstack-start-entry.ts | 20 + apps/cloud/vitest.config.ts | 21 + apps/cloud/wrangler.miniflare.jsonc | 1 + apps/cloud/wrangler.test.jsonc | 1 + .../.executor-selfhost/secret.key | 1 + apps/host-selfhost/CHANGELOG.md | 6 + apps/host-selfhost/Dockerfile | 39 + apps/host-selfhost/executor.config.ts | 28 + apps/host-selfhost/package.json | 58 ++ apps/host-selfhost/src/account/account-api.ts | 27 + .../account/better-auth-account-provider.ts | 179 ++++ apps/host-selfhost/src/account/index.ts | 7 + apps/host-selfhost/src/app.ts | 124 +++ .../src/auth/better-auth.test.ts | 84 ++ apps/host-selfhost/src/auth/better-auth.ts | 128 +++ apps/host-selfhost/src/auth/identity.ts | 84 ++ apps/host-selfhost/src/auth/index.ts | 45 + apps/host-selfhost/src/auth/seed.ts | 67 ++ apps/host-selfhost/src/boot.test.ts | 43 + apps/host-selfhost/src/config.ts | 88 ++ apps/host-selfhost/src/db/self-host-db.ts | 179 ++++ apps/host-selfhost/src/execution.ts | 80 ++ apps/host-selfhost/src/index.ts | 9 + apps/host-selfhost/src/mcp/auth.ts | 180 ++++ apps/host-selfhost/src/mcp/index.ts | 78 ++ apps/host-selfhost/src/mcp/mcp-oauth.test.ts | 160 ++++ apps/host-selfhost/src/mcp/mcp.test.ts | 171 ++++ apps/host-selfhost/src/mcp/session-store.ts | 229 +++++ apps/host-selfhost/src/multi-user.test.ts | 104 +++ apps/host-selfhost/src/observability.ts | 11 + apps/host-selfhost/src/plugins.ts | 12 + .../host-selfhost/src/scope-isolation.test.ts | 55 ++ .../src/secrets-integration.test.ts | 75 ++ apps/host-selfhost/src/serve.ts | 49 ++ apps/host-selfhost/src/sources-mcp.test.ts | 144 ++++ apps/host-selfhost/src/sources.test.ts | 76 ++ apps/host-selfhost/src/testing/test-app.ts | 224 +++++ apps/host-selfhost/tsconfig.json | 24 + apps/host-selfhost/vite.config.ts | 136 +++ apps/host-selfhost/vitest.config.ts | 8 + apps/host-selfhost/web/auth-client.ts | 9 + apps/host-selfhost/web/entry-client.tsx | 15 + apps/host-selfhost/web/index.html | 22 + apps/host-selfhost/web/login.tsx | 109 +++ apps/host-selfhost/web/routeTree.gen.ts | 252 ++++++ apps/host-selfhost/web/router.tsx | 10 + apps/host-selfhost/web/routes/__root.tsx | 58 ++ apps/host-selfhost/web/routes/api-keys.tsx | 6 + apps/host-selfhost/web/routes/connections.tsx | 6 + apps/host-selfhost/web/routes/index.tsx | 6 + .../web/routes/plugins.$pluginId.$.tsx | 31 + apps/host-selfhost/web/routes/policies.tsx | 6 + .../web/routes/resume.$executionId.tsx | 117 +++ apps/host-selfhost/web/routes/secrets.tsx | 23 + .../web/routes/sources.$namespace.tsx | 9 + .../web/routes/sources.add.$pluginKey.tsx | 20 + apps/host-selfhost/web/routes/tools.tsx | 6 + apps/local/package.json | 1 + .../server/__test-helpers__/libsql-test-db.ts | 100 +++ .../__test-helpers__/pre-0007-schema.ts | 7 +- apps/local/src/server/app.ts | 122 +++ .../src/server/auth-tool-failures.test.ts | 9 +- apps/local/src/server/db-upgrade.test.ts | 142 ++- apps/local/src/server/db-upgrade.ts | 65 +- apps/local/src/server/executor.ts | 151 ++-- ...google-discovery-openapi-migration.test.ts | 265 +++--- .../google-discovery-openapi-migration.ts | 191 ++-- apps/local/src/server/identity.ts | 50 ++ apps/local/src/server/libsql.ts | 72 ++ apps/local/src/server/main.ts | 84 +- .../src/server/mcp-browser-resume.test.ts | 2 +- apps/local/src/server/mcp-oauth.test.ts | 9 +- apps/local/src/server/mcp.ts | 14 +- .../migrate-google-discovery-bindings.test.ts | 211 ++--- .../server/migrate-graphql-bindings.test.ts | 231 +++-- .../src/server/migrate-mcp-bindings.test.ts | 222 ++--- .../server/migrate-oauth-connections.test.ts | 68 +- .../server/migrate-openapi-bindings.test.ts | 238 +++-- .../src/server/migration-nesting.test.ts | 17 +- apps/local/src/server/observability.ts | 35 +- apps/local/src/server/sqlite-fumadb.ts | 60 +- apps/local/src/server/sqlite-import.test.ts | 179 ++-- apps/local/src/server/sqlite-import.ts | 77 +- bun.lock | 182 +++- package.json | 2 + packages/core/api/package.json | 1 + packages/core/api/src/account/api.ts | 242 ++++++ packages/core/api/src/account/handlers.ts | 87 ++ packages/core/api/src/account/service.ts | 75 ++ packages/core/api/src/client.ts | 8 + packages/core/api/src/handlers/index.ts | 1 - packages/core/api/src/index.ts | 26 + packages/core/api/src/server.ts | 82 ++ .../api/src/server/console-error-capture.ts | 39 + .../src/server/execution-stack-middleware.ts | 192 +++++ .../core/api/src/server/execution-stack.ts | 117 +++ packages/core/api/src/server/executor-app.ts | 594 +++++++++++++ .../core/api/src/server/executor-fuma-db.ts | 51 ++ .../src/server/fixed-execution-middleware.ts | 130 +++ .../core/api/src/server/host-foundation.ts | 223 +++++ packages/core/api/src/server/identity.ts | 130 +++ .../core/api/src/server}/request-scoped.ts | 0 packages/core/api/src/server/router-config.ts | 11 + .../core/api/src/server/scoped-executor.ts | 135 +++ packages/core/execution/src/promise.ts | 3 +- packages/core/execution/src/tool-invoker.ts | 12 +- packages/core/sdk/package.json | 10 +- packages/core/sdk/src/connections.test.ts | 8 +- packages/core/sdk/src/executor-fuma-db.ts | 93 ++ packages/core/sdk/src/executor.ts | 30 +- packages/core/sdk/src/host-internal.ts | 32 + packages/core/sdk/src/index.ts | 128 +-- packages/core/sdk/src/plugin.ts | 2 +- packages/core/sdk/src/promise.ts | 4 +- packages/core/sdk/src/scope.test.ts | 76 ++ packages/core/sdk/src/scope.ts | 73 ++ packages/core/sdk/src/sqlite-test-db.ts | 49 +- packages/core/sdk/src/types.ts | 17 +- packages/core/sdk/tsup.config.ts | 1 + packages/hosts/mcp/package.json | 9 +- packages/hosts/mcp/src/envelope.test.ts | 135 +++ packages/hosts/mcp/src/envelope.ts | 278 ++++++ packages/hosts/mcp/src/index.ts | 37 +- packages/hosts/mcp/src/seams.ts | 279 ++++++ .../{server.test.ts => tool-server.test.ts} | 2 +- .../mcp/src/{server.ts => tool-server.ts} | 0 .../plugins/encrypted-secrets/CHANGELOG.md | 6 + .../plugins/encrypted-secrets/package.json | 26 + .../encrypted-secrets/src/index.test.ts | Bin 0 -> 6066 bytes .../plugins/encrypted-secrets/src/index.ts | 149 ++++ .../plugins/encrypted-secrets/tsconfig.json | 24 + .../plugins/encrypted-secrets/tsup.config.ts | 12 + .../encrypted-secrets/vitest.config.ts | 8 + .../openapi/src/sdk/real-specs.test.ts | 6 +- .../workos-vault/src/sdk/secret-store.ts | 10 +- packages/react/package.json | 1 + packages/react/src/api/account-atoms.tsx | 46 + packages/react/src/api/account-client.tsx | 33 + packages/react/src/api/client.tsx | 2 +- .../react/src/multiplayer/auth-context.tsx | 99 +++ packages/react/src/multiplayer/shell.tsx | 391 +++++++++ packages/react/src/pages/api-keys.tsx | 266 ++++++ packages/react/src/pages/org.tsx | 480 +++++++++++ 233 files changed, 14156 insertions(+), 5370 deletions(-) create mode 100644 .dockerignore create mode 100644 apps/cloud/src/account/account-api.ts create mode 100644 apps/cloud/src/account/workos-account-service.test.ts create mode 100644 apps/cloud/src/account/workos-account-service.ts delete mode 100644 apps/cloud/src/api.ts create mode 100644 apps/cloud/src/api/execution-stack-metered.ts create mode 100644 apps/cloud/src/api/extension-routes.ts delete mode 100644 apps/cloud/src/api/protected-layers.ts create mode 100644 apps/cloud/src/app.ts delete mode 100644 apps/cloud/src/auth/api-key-errors.ts delete mode 100644 apps/cloud/src/auth/authorize-organization.ts create mode 100644 apps/cloud/src/auth/bearer.ts delete mode 100644 apps/cloud/src/auth/organization-limits.ts create mode 100644 apps/cloud/src/auth/organization.ts delete mode 100644 apps/cloud/src/auth/resolve-organization.ts create mode 100644 apps/cloud/src/auth/workos-auth-provider.ts create mode 100644 apps/cloud/src/edge/index.ts create mode 100644 apps/cloud/src/edge/marketing.ts create mode 100644 apps/cloud/src/edge/posthog.ts rename apps/cloud/src/{ => edge}/sentry-tunnel.ts (64%) delete mode 100644 apps/cloud/src/mcp.ts create mode 100644 apps/cloud/src/mcp/auth-provider.ts create mode 100644 apps/cloud/src/mcp/auth.ts create mode 100644 apps/cloud/src/mcp/do-headers.ts create mode 100644 apps/cloud/src/mcp/index.ts rename apps/cloud/src/{mcp-auth.ts => mcp/jwt.ts} (86%) create mode 100644 apps/cloud/src/mcp/mount.ts create mode 100644 apps/cloud/src/mcp/oauth-metadata.ts create mode 100644 apps/cloud/src/mcp/reporter.ts rename apps/cloud/src/{mcp-session.ts => mcp/session-durable-object.ts} (95%) create mode 100644 apps/cloud/src/mcp/session-store.ts create mode 100644 apps/cloud/src/mcp/telemetry.ts delete mode 100644 apps/cloud/src/org/compose.ts delete mode 100644 apps/cloud/src/org/member-limits.ts delete mode 100644 apps/cloud/src/services/executor.ts rename apps/cloud/src/{org => services}/member-limits.node.test.ts (98%) rename apps/cloud/src/{auth => services}/organization-limits.node.test.ts (98%) delete mode 100644 apps/cloud/src/web/api-key-atoms.ts create mode 100644 apps/cloud/src/web/components/org-menu-slot.tsx create mode 100644 apps/cloud/src/web/components/support-slot.tsx create mode 100644 apps/cloud/test-stubs/tanstack-start-entry.ts create mode 100644 apps/host-selfhost/.executor-selfhost/secret.key create mode 100644 apps/host-selfhost/CHANGELOG.md create mode 100644 apps/host-selfhost/Dockerfile create mode 100644 apps/host-selfhost/executor.config.ts create mode 100644 apps/host-selfhost/package.json create mode 100644 apps/host-selfhost/src/account/account-api.ts create mode 100644 apps/host-selfhost/src/account/better-auth-account-provider.ts create mode 100644 apps/host-selfhost/src/account/index.ts create mode 100644 apps/host-selfhost/src/app.ts create mode 100644 apps/host-selfhost/src/auth/better-auth.test.ts create mode 100644 apps/host-selfhost/src/auth/better-auth.ts create mode 100644 apps/host-selfhost/src/auth/identity.ts create mode 100644 apps/host-selfhost/src/auth/index.ts create mode 100644 apps/host-selfhost/src/auth/seed.ts create mode 100644 apps/host-selfhost/src/boot.test.ts create mode 100644 apps/host-selfhost/src/config.ts create mode 100644 apps/host-selfhost/src/db/self-host-db.ts create mode 100644 apps/host-selfhost/src/execution.ts create mode 100644 apps/host-selfhost/src/index.ts create mode 100644 apps/host-selfhost/src/mcp/auth.ts create mode 100644 apps/host-selfhost/src/mcp/index.ts create mode 100644 apps/host-selfhost/src/mcp/mcp-oauth.test.ts create mode 100644 apps/host-selfhost/src/mcp/mcp.test.ts create mode 100644 apps/host-selfhost/src/mcp/session-store.ts create mode 100644 apps/host-selfhost/src/multi-user.test.ts create mode 100644 apps/host-selfhost/src/observability.ts create mode 100644 apps/host-selfhost/src/plugins.ts create mode 100644 apps/host-selfhost/src/scope-isolation.test.ts create mode 100644 apps/host-selfhost/src/secrets-integration.test.ts create mode 100644 apps/host-selfhost/src/serve.ts create mode 100644 apps/host-selfhost/src/sources-mcp.test.ts create mode 100644 apps/host-selfhost/src/sources.test.ts create mode 100644 apps/host-selfhost/src/testing/test-app.ts create mode 100644 apps/host-selfhost/tsconfig.json create mode 100644 apps/host-selfhost/vite.config.ts create mode 100644 apps/host-selfhost/vitest.config.ts create mode 100644 apps/host-selfhost/web/auth-client.ts create mode 100644 apps/host-selfhost/web/entry-client.tsx create mode 100644 apps/host-selfhost/web/index.html create mode 100644 apps/host-selfhost/web/login.tsx create mode 100644 apps/host-selfhost/web/routeTree.gen.ts create mode 100644 apps/host-selfhost/web/router.tsx create mode 100644 apps/host-selfhost/web/routes/__root.tsx create mode 100644 apps/host-selfhost/web/routes/api-keys.tsx create mode 100644 apps/host-selfhost/web/routes/connections.tsx create mode 100644 apps/host-selfhost/web/routes/index.tsx create mode 100644 apps/host-selfhost/web/routes/plugins.$pluginId.$.tsx create mode 100644 apps/host-selfhost/web/routes/policies.tsx create mode 100644 apps/host-selfhost/web/routes/resume.$executionId.tsx create mode 100644 apps/host-selfhost/web/routes/secrets.tsx create mode 100644 apps/host-selfhost/web/routes/sources.$namespace.tsx create mode 100644 apps/host-selfhost/web/routes/sources.add.$pluginKey.tsx create mode 100644 apps/host-selfhost/web/routes/tools.tsx create mode 100644 apps/local/src/server/__test-helpers__/libsql-test-db.ts create mode 100644 apps/local/src/server/app.ts create mode 100644 apps/local/src/server/identity.ts create mode 100644 apps/local/src/server/libsql.ts create mode 100644 packages/core/api/src/account/api.ts create mode 100644 packages/core/api/src/account/handlers.ts create mode 100644 packages/core/api/src/account/service.ts create mode 100644 packages/core/api/src/server/console-error-capture.ts create mode 100644 packages/core/api/src/server/execution-stack-middleware.ts create mode 100644 packages/core/api/src/server/execution-stack.ts create mode 100644 packages/core/api/src/server/executor-app.ts create mode 100644 packages/core/api/src/server/executor-fuma-db.ts create mode 100644 packages/core/api/src/server/fixed-execution-middleware.ts create mode 100644 packages/core/api/src/server/host-foundation.ts create mode 100644 packages/core/api/src/server/identity.ts rename {apps/cloud/src/api => packages/core/api/src/server}/request-scoped.ts (100%) create mode 100644 packages/core/api/src/server/router-config.ts create mode 100644 packages/core/api/src/server/scoped-executor.ts create mode 100644 packages/core/sdk/src/executor-fuma-db.ts create mode 100644 packages/core/sdk/src/host-internal.ts create mode 100644 packages/core/sdk/src/scope.test.ts create mode 100644 packages/hosts/mcp/src/envelope.test.ts create mode 100644 packages/hosts/mcp/src/envelope.ts create mode 100644 packages/hosts/mcp/src/seams.ts rename packages/hosts/mcp/src/{server.test.ts => tool-server.test.ts} (99%) rename packages/hosts/mcp/src/{server.ts => tool-server.ts} (100%) create mode 100644 packages/plugins/encrypted-secrets/CHANGELOG.md create mode 100644 packages/plugins/encrypted-secrets/package.json create mode 100644 packages/plugins/encrypted-secrets/src/index.test.ts create mode 100644 packages/plugins/encrypted-secrets/src/index.ts create mode 100644 packages/plugins/encrypted-secrets/tsconfig.json create mode 100644 packages/plugins/encrypted-secrets/tsup.config.ts create mode 100644 packages/plugins/encrypted-secrets/vitest.config.ts create mode 100644 packages/react/src/api/account-atoms.tsx create mode 100644 packages/react/src/api/account-client.tsx create mode 100644 packages/react/src/multiplayer/auth-context.tsx create mode 100644 packages/react/src/multiplayer/shell.tsx create mode 100644 packages/react/src/pages/api-keys.tsx create mode 100644 packages/react/src/pages/org.tsx diff --git a/.dockerignore b/.dockerignore new file mode 100644 index 000000000..792e93cda --- /dev/null +++ b/.dockerignore @@ -0,0 +1,10 @@ +**/node_modules +.git +.reference +.turbo +**/dist +**/.executor* +**/coverage +**/.next +**/*.log +.claude diff --git a/apps/cloud/src/account/account-api.ts b/apps/cloud/src/account/account-api.ts new file mode 100644 index 000000000..38ed1faaa --- /dev/null +++ b/apps/cloud/src/account/account-api.ts @@ -0,0 +1,113 @@ +import { HttpRouter, HttpServerRequest } from "effect/unstable/http"; +import { Effect, Layer } from "effect"; + +import { + AccountProvider, + makeAccountApiLayer, + requestScopedMiddleware, +} from "@executor-js/api/server"; + +import { ApiKeyService } from "../auth/api-keys"; +import { UserStoreService } from "../auth/context"; +import { sessionFromSealed, type Session } from "../auth/middleware"; +import { WorkOSClient } from "../auth/workos"; +import { AutumnService } from "../services/autumn"; +import { DbService } from "../services/db"; +import { AccountCaller, workosAccountProvider } from "./workos-account-service"; + +// --------------------------------------------------------------------------- +// Cloud account API — the shared, provider-neutral `AccountHandlers` backed by +// the WorkOS `AccountProvider`, mounted at the same `/account/*` paths the +// shared React `AccountApiClient` hits. Identical UI to self-host; only the +// service implementation differs. +// +// The caller is resolved ONCE per request by this middleware — the SAME +// cookie-only credential `SessionAuthLive` accepts: `WorkOSClient +// .authenticateSealedSession` over the request's `wos-session` cookie. The +// resolved session (or `null`) is injected into the service as `AccountCaller`; +// the service no longer parses the cookie itself, so `/account/*` accepts +// exactly the same credential set as before (cookie session only — NOT api-key +// Bearer, which is the executor `/api/*` plane). This API still carries NO +// HttpApiMiddleware: auth is the single resolution path in this middleware. +// +// GOTCHA: an HttpApi handler's service requirement (`AccountProvider`) is NOT +// erased by plain `Layer.provide`/`provideMerge` on the builder layer — it +// leaks into the app layer's requirements and breaks the build. So `AccountProvider` +// is provided through a per-request router middleware (like `protected.ts`'s +// `ExecutionStackMiddleware`): long-lived services (`WorkOSClient` from the boot +// core; `AutumnService` from this account layer's own provide — billing is +// app-only and not on the neutral boot core) are pulled from context, while the +// per-request `UserStoreService` (postgres) comes from `rsLive` combined in, so +// the socket lives in the request fiber's scope. `rsLive` is a parameter so +// tests can swap a fake. +// --------------------------------------------------------------------------- + +// Builds the WorkOS `AccountProvider` per request, providing it to the handler. +// Long-lived `WorkOSClient | AutumnService` come from the surrounding context +// (Autumn provided by `makeAccountApiLive` for the seat-gate); the per-request +// `UserStoreService` is supplied by the combined `rsLive` layer. +// `ApiKeyService.WorkOS` is built here on top of the boot `WorkOSClient`. +const AccountProviderMiddleware = HttpRouter.middleware<{ provides: AccountProvider }>()( + Effect.gen(function* () { + // Long-lived services only (built once at boot). `UserStoreService` and + // `DbService` are NOT grabbed here — they come per request from the combined + // `requestScopedMiddleware(rsLive)` layer, which folds them into this + // middleware's body context (so they drop out of `requires`). + const longLived = yield* Effect.context(); + const workos = yield* WorkOSClient; + return (httpEffect) => + Effect.gen(function* () { + // Resolve the caller ONCE off the request's `wos-session` cookie — the + // same credential `SessionAuthLive` accepts (`authenticateSealedSession` + // over the sealed-session cookie). `null` => no/invalid session, which + // the service maps to AccountUnauthorized (401). + const request = yield* HttpServerRequest.HttpServerRequest; + const cookieValue = request.cookies["wos-session"] ?? ""; + const resolved = yield* workos + .authenticateSealedSession(cookieValue) + .pipe(Effect.orElseSucceed(() => null)); + // The account API never re-sets the cookie, so the fallback sealed + // session is `""` (vs `SessionAuthLive`, which keeps the inbound cookie). + const session: Session | null = resolved ? sessionFromSealed(resolved, "") : null; + + // Built inside the request body so the WorkOS account service closes + // over the per-request `UserStoreService` (postgres socket) supplied by + // the combined request-scoped layer. + const accountProvider = yield* Effect.provide( + AccountProvider.asEffect(), + workosAccountProvider.pipe( + Layer.provide(ApiKeyService.WorkOS), + Layer.provide(Layer.succeed(AccountCaller)({ session })), + ), + ); + return yield* Effect.provideService(httpEffect, AccountProvider, accountProvider); + }).pipe(Effect.provideContext(longLived)); + }), +); + +/** + * The cloud account-provider middleware fed to `ExecutorApp.make`'s + * `providers.account` slot: the per-request `AccountProvider`-providing + * middleware combined with `requestScopedMiddleware(rsLive)` (so the WorkOS + * account service closes over the per-request postgres socket). `AutumnService` + * (the seat-gate) stays a residual requirement, satisfied by the app `boot`. + */ +export const workosAccountMiddleware = (rsLive: Layer.Layer) => + AccountProviderMiddleware.combine(requestScopedMiddleware(rsLive)).layer; + +export const makeAccountApiLive = (rsLive: Layer.Layer) => { + // Cloud builds the WorkOS `AccountProvider` INSIDE the request body (so it + // closes over the per-request postgres socket), so it can't be a self- + // contained `Layer` — it combines its own middleware with + // `requestScopedMiddleware(rsLive)` and passes that to the shared mount + // helper. Cloud serves the account API at root (no prefixed router), matching + // the rest of the cloud router. + // + // `AutumnService.Default` is provided HERE because the account provider's + // seat-gate (`reserveMemberSlot` / member-limits) reads it — one of the few + // app-only billing touchpoints. It is NOT on the neutral boot core. + const accountMiddleware = AccountProviderMiddleware.combine( + requestScopedMiddleware(rsLive), + ).layer; + return makeAccountApiLayer(accountMiddleware).pipe(Layer.provideMerge(AutumnService.Default)); +}; diff --git a/apps/cloud/src/account/workos-account-service.test.ts b/apps/cloud/src/account/workos-account-service.test.ts new file mode 100644 index 000000000..7bb088f33 --- /dev/null +++ b/apps/cloud/src/account/workos-account-service.test.ts @@ -0,0 +1,192 @@ +import { HttpApiBuilder } from "effect/unstable/httpapi"; +import { HttpRouter, HttpServer } from "effect/unstable/http"; +import { describe, expect, it } from "@effect/vitest"; +import { Effect, Layer } from "effect"; + +import { AccountHttpApi } from "@executor-js/api"; +import { AccountHandlers } from "@executor-js/api/server"; + +import { ApiKeyService } from "../auth/api-keys"; +import { UserStoreService } from "../auth/context"; +import type { Session } from "../auth/middleware"; +import { WorkOSClient, type WorkOSClientService } from "../auth/workos"; +import { AutumnService } from "../services/autumn"; +import { AccountCaller, workosAccountProvider } from "./workos-account-service"; + +// --------------------------------------------------------------------------- +// Mounts the SHARED, provider-neutral AccountHandlers over the cloud WorkOS +// AccountProvider and drives the routes through a web handler, proving that +// `/account/me` (authenticated) and `/account/api-keys` return the neutral +// shapes. The caller is now resolved ONCE by the cookie-only session +// middleware (account-api.ts) and injected as `AccountCaller`; these tests +// drive the service with that resolved caller directly. The shared React +// `AccountApiClient` hits these exact paths. +// --------------------------------------------------------------------------- + +const authedSession: Session = { + accountId: "user_1", + email: "user@test.com", + name: "Test User", + avatarUrl: null, + organizationId: "org_1", + sealedSession: "sealed_session", + refreshedSession: null, +}; + +const orgLessSession: Session = { ...authedSession, organizationId: null }; + +const stubWorkOS = (overrides: Partial = {}) => + Layer.succeed( + WorkOSClient, + new Proxy({} as WorkOSClientService, { + get: (_target, prop) => { + if (typeof prop === "string" && prop in overrides) { + return overrides[prop as keyof WorkOSClientService]; + } + return () => Effect.void; + }, + }), + ); + +// User store stub — `resolveOrganization` reads `getOrganization` first, so +// returning the mirrored org short-circuits the WorkOS fallback. +const stubUserStore = Layer.succeed(UserStoreService)({ + use: ((fn: (s: unknown) => Promise) => + Effect.promise(() => + fn({ + getOrganization: () => Promise.resolve({ id: "org_1", name: "Test Org" }), + upsertOrganization: (org: { id: string; name: string }) => Promise.resolve(org), + }), + )) as UserStoreService["Service"]["use"], +}); + +const stubApiKeys = Layer.succeed(ApiKeyService)({ + validate: () => Effect.succeed(null), + listUserKeys: () => + Effect.succeed([ + { + id: "key_1", + name: "Local CLI", + obfuscatedValue: "exk_…a1b2", + createdAt: "2026-04-01T00:00:00Z", + updatedAt: "2026-04-01T00:00:00Z", + lastUsedAt: null, + }, + ]), + createUserKey: () => + Effect.succeed({ + id: "key_2", + name: "New key", + obfuscatedValue: "exk_…c3d4", + createdAt: "2026-04-02T00:00:00Z", + updatedAt: "2026-04-02T00:00:00Z", + lastUsedAt: null, + value: "exk_secret_value", + }), + revokeUserKey: () => Effect.void, +} satisfies ApiKeyService["Service"]); + +const stubAutumn = Layer.succeed(AutumnService)({ + use: (() => Effect.succeed({ subscriptions: [] })) as AutumnService["Service"]["use"], + trackExecution: () => Effect.void, +} satisfies AutumnService["Service"]); + +const makeFetch = (caller: Session | null, workos: Partial = {}) => { + const serviceLive = workosAccountProvider.pipe( + Layer.provide(stubWorkOS(workos)), + Layer.provide(stubApiKeys), + Layer.provide(stubAutumn), + Layer.provide(stubUserStore), + Layer.provide(Layer.succeed(AccountCaller)({ session: caller })), + ); + const apiLayer = HttpApiBuilder.layer(AccountHttpApi).pipe( + Layer.provide(AccountHandlers), + Layer.provideMerge(serviceLive), + Layer.provideMerge(HttpServer.layerServices), + Layer.provideMerge(Layer.succeed(HttpRouter.RouterConfig)({ maxParamLength: 1000 })), + ); + const web = HttpRouter.toWebHandler(apiLayer, { disableLogger: true }); + return web.handler as (request: Request) => Promise; +}; + +// The service only reads `data[*].organizationId` + `data[*].status`, so stub +// the minimal membership-list shape matching that contract rather than the full +// WorkOS SDK types — same approach as `auth/handlers.node.test.ts`. +const stubMemberships = ( + data: ReadonlyArray<{ organizationId: string; status: string }>, +): WorkOSClientService["listUserMemberships"] => + // oxlint-disable-next-line executor/no-double-cast -- test stub: minimal contract shape, not the full SDK list type + (() => Effect.succeed({ data })) as unknown as WorkOSClientService["listUserMemberships"]; + +describe("Cloud Account API (neutral surface, WorkOS-backed)", () => { + it.effect("GET /account/me returns the neutral user + organization for an authed session", () => + Effect.gen(function* () { + const fetch = makeFetch(authedSession, { + listUserMemberships: stubMemberships([{ organizationId: "org_1", status: "active" }]), + }); + + const response = yield* Effect.promise(() => + fetch(new Request("http://test.local/account/me")), + ); + expect(response.status).toBe(200); + const body = yield* Effect.promise(() => response.json()); + expect(body).toEqual({ + user: { + id: "user_1", + email: "user@test.com", + name: "Test User", + avatarUrl: null, + }, + organization: { id: "org_1", name: "Test Org" }, + }); + }), + ); + + it.effect("GET /account/me returns 401 when there is no valid session", () => + Effect.gen(function* () { + const fetch = makeFetch(null); + + const response = yield* Effect.promise(() => + fetch(new Request("http://test.local/account/me")), + ); + expect(response.status).toBe(401); + }), + ); + + it.effect("GET /account/api-keys returns the caller's keys in the neutral shape", () => + Effect.gen(function* () { + const fetch = makeFetch(authedSession, { + listUserMemberships: stubMemberships([{ organizationId: "org_1", status: "active" }]), + }); + + const response = yield* Effect.promise(() => + fetch(new Request("http://test.local/account/api-keys")), + ); + expect(response.status).toBe(200); + const body = (yield* Effect.promise(() => response.json())) as { + apiKeys: ReadonlyArray<{ id: string; name: string }>; + }; + expect(body.apiKeys).toEqual([ + { + id: "key_1", + name: "Local CLI", + obfuscatedValue: "exk_…a1b2", + createdAt: "2026-04-01T00:00:00Z", + updatedAt: "2026-04-01T00:00:00Z", + lastUsedAt: null, + }, + ]); + }), + ); + + it.effect("GET /account/api-keys returns 403 when the session has no organization", () => + Effect.gen(function* () { + const fetch = makeFetch(orgLessSession); + + const response = yield* Effect.promise(() => + fetch(new Request("http://test.local/account/api-keys")), + ); + expect(response.status).toBe(403); + }), + ); +}); diff --git a/apps/cloud/src/account/workos-account-service.ts b/apps/cloud/src/account/workos-account-service.ts new file mode 100644 index 000000000..917ea3885 --- /dev/null +++ b/apps/cloud/src/account/workos-account-service.ts @@ -0,0 +1,317 @@ +import { Context, Effect, Layer } from "effect"; + +import { AccountProvider } from "@executor-js/api/server"; +import { + AccountError, + AccountForbidden, + AccountNoOrganization, + AccountUnauthorized, +} from "@executor-js/api"; + +import { ApiKeyService } from "../auth/api-keys"; +import { UserStoreService } from "../auth/context"; +import type { Session } from "../auth/middleware"; +import { WorkOSClient } from "../auth/workos"; +import { authorizeOrganization } from "../auth/organization"; +import { AutumnService } from "../services/autumn"; +import { getMemberLimitForPlan, selectActiveMemberLimitPlan } from "../services/autumn-plans"; + +// The per-request resolved caller, injected by the cookie-only session +// middleware in `account-api.ts`. Carries the authenticated WorkOS session, or +// `null` when the `wos-session` cookie is missing/invalid — the service maps +// `null` to AccountUnauthorized (401) at the method boundary, exactly where the +// inline `requireSession` used to. This is the SINGLE cookie-resolution path: +// the same `WorkOSClient.authenticateSealedSession` the rest of cloud uses. +export class AccountCaller extends Context.Service< + AccountCaller, + { readonly session: Session | null } +>()("@executor-js/cloud/AccountCaller") {} + +// --------------------------------------------------------------------------- +// Cloud AccountProvider — implements the provider-neutral account surface over +// WorkOS. The shared `AccountHandlers` call this; self-host provides its own +// Better Auth implementation of the same shape. +// +// The caller is resolved ONCE per request by the cookie-only session +// middleware in `account-api.ts` (the SAME `WorkOSClient.authenticateSealedSession` +// off the `wos-session` cookie that `SessionAuthLive` uses) and injected here as +// the `SessionContext`. This service no longer parses the cookie itself: there +// is exactly one cookie-resolution path. It still accepts ONLY the wos-session +// sealed-session cookie — it is NOT routed through the api-key-accepting +// executor identity provider — so the credentials `/account/*` accepts are +// byte-identical to before. +// +// It then runs the EXACT logic that used to live in `auth/handlers.ts` +// (me / API keys) and `org/handlers.ts` (members / roles / invite / role / +// name). Native WorkOS / store failures are mapped at this boundary onto the +// neutral account errors so the shared UI sees one shape: +// WorkOSError | UserStoreError | ApiKeyManagementError → AccountError +// no organization in session → AccountNoOrganization +// not-an-admin / over-seat-limit / not-allowed → AccountForbidden +// --------------------------------------------------------------------------- + +const MAX_API_KEY_NAME_LENGTH = 80; + +// Lift any cloud-side tagged failure (WorkOSError / UserStoreError / +// ApiKeyManagementError — none of which carry a safe user-facing message) onto +// the neutral AccountError (500), matching the cloud handlers' httpApiStatus. +const toAccountError = () => Effect.fail(new AccountError({ message: "Account request failed" })); + +export const workosAccountProvider: Layer.Layer< + AccountProvider, + never, + WorkOSClient | UserStoreService | ApiKeyService | AutumnService | AccountCaller +> = Layer.effect(AccountProvider)( + Effect.gen(function* () { + const workos = yield* WorkOSClient; + const apiKeys = yield* ApiKeyService; + const autumn = yield* AutumnService; + const users = yield* UserStoreService; + + // The caller, resolved once per request by the cookie-only session + // middleware (account-api.ts) — the same credential `SessionAuthLive` + // accepts. The method bodies read the already-authenticated session rather + // than re-parsing the cookie. `null` => no/invalid session. + const caller = yield* AccountCaller; + + // Capture the resolved service context once so the method bodies — which + // call `authorizeOrganization` (yields `WorkOSClient` + `UserStoreService`) — + // can be erased to `R = never`, as the neutral AccountProvider shape + // requires. Provided per method below. + const ctx = yield* Effect.context(); + + // Unauthenticated (missing/invalid session) => AccountUnauthorized, exactly + // as the old inline `requireSession` did. + const requireSession = () => + caller.session + ? Effect.succeed(caller.session) + : Effect.fail(new AccountUnauthorized()); + + // Like cloud's `requireSessionOrganization`: an authenticated session that + // currently holds an active membership in its session org. Yields the + // session + resolved org, or AccountNoOrganization. + const requireOrganization = () => + Effect.gen(function* () { + const session = yield* requireSession(); + if (!session.organizationId) { + return yield* new AccountNoOrganization(); + } + const org = yield* authorizeOrganization(session.accountId, session.organizationId).pipe( + Effect.provideContext(ctx), + Effect.mapError(() => new AccountNoOrganization()), + ); + if (!org) return yield* new AccountNoOrganization(); + return { session, org }; + }); + + // Mirror of org/handlers `requireAdmin`, but scoped to the resolved org. + const requireAdmin = (accountId: string, organizationId: string) => + Effect.gen(function* () { + const membership = yield* workos + .getUserOrgMembership(organizationId, accountId) + .pipe(Effect.catchTag("WorkOSError", toAccountError)); + if (!membership || membership.role?.slug !== "admin") { + return yield* new AccountForbidden(); + } + }); + + // Mirror of org/handlers `assertMembershipInSessionOrg` — ownership check so + // an admin can't mutate a membership id from another org. + const assertMembershipInOrg = (organizationId: string, membershipId: string) => + Effect.gen(function* () { + const membership = yield* workos + .getOrgMembership(membershipId) + .pipe(Effect.catchCause(() => Effect.succeed(null))); + if (!membership || membership.organizationId !== organizationId) { + return yield* new AccountForbidden(); + } + }); + + // Mirror of org/handlers `getMemberSeats` — live seat usage from WorkOS. + const getMemberSeats = (organizationId: string) => + Effect.gen(function* () { + const customer = yield* autumn.use((client) => + client.customers.getOrCreate({ customerId: organizationId }), + ); + const planId = selectActiveMemberLimitPlan(customer.subscriptions); + const limit = getMemberLimitForPlan(planId); + + const memberships = yield* workos.listOrgMembers(organizationId); + const invitations = yield* workos.listPendingInvitations(organizationId); + + return { + used: memberships.data.length + invitations.data.length, + granted: limit ?? 0, + unlimited: limit === null, + }; + }); + + // Mirror of org/handlers `reserveMemberSlot` — fail closed on lookup error. + const reserveMemberSlot = (organizationId: string) => + Effect.gen(function* () { + const seats = yield* getMemberSeats(organizationId).pipe( + Effect.catchCause(() => Effect.fail(new AccountForbidden())), + ); + if (!seats.unlimited && seats.used >= seats.granted) { + return yield* new AccountForbidden(); + } + }); + + return AccountProvider.of({ + me: () => + Effect.gen(function* () { + const session = yield* requireSession(); + const org = session.organizationId + ? yield* authorizeOrganization(session.accountId, session.organizationId).pipe( + Effect.provideContext(ctx), + Effect.orElseSucceed(() => null), + ) + : null; + return { + user: { + id: session.accountId, + email: session.email, + name: session.name, + avatarUrl: session.avatarUrl, + }, + organization: org ? { id: org.id, name: org.name } : null, + }; + }), + + listApiKeys: () => + Effect.gen(function* () { + const { session, org } = yield* requireOrganization(); + const keys = yield* apiKeys + .listUserKeys({ accountId: session.accountId, organizationId: org.id }) + .pipe(Effect.catchTag("ApiKeyManagementError", toAccountError)); + return { apiKeys: keys }; + }), + + createApiKey: (_headers, name) => + Effect.gen(function* () { + const { session, org } = yield* requireOrganization(); + const trimmed = name.trim().slice(0, MAX_API_KEY_NAME_LENGTH); + if (!trimmed) { + return yield* new AccountError({ message: "API key name is required" }); + } + return yield* apiKeys + .createUserKey({ accountId: session.accountId, organizationId: org.id, name: trimmed }) + .pipe(Effect.catchTag("ApiKeyManagementError", toAccountError)); + }), + + revokeApiKey: (_headers, apiKeyId) => + Effect.gen(function* () { + const { session, org } = yield* requireOrganization(); + const ownedKeys = yield* apiKeys + .listUserKeys({ accountId: session.accountId, organizationId: org.id }) + .pipe(Effect.catchTag("ApiKeyManagementError", toAccountError)); + if (!ownedKeys.some((key) => key.id === apiKeyId)) { + return yield* new AccountError({ message: "API key not found" }); + } + yield* apiKeys + .revokeUserKey({ keyId: apiKeyId }) + .pipe(Effect.catchTag("ApiKeyManagementError", toAccountError)); + return { success: true }; + }), + + listMembers: () => + Effect.gen(function* () { + const { session, org } = yield* requireOrganization(); + + // Seats fall back to safe display defaults on lookup error — never + // blank the page over a transient Autumn/WorkOS hiccup. The real cap + // gate lives in `reserveMemberSlot`, which fails closed. + const seats = yield* getMemberSeats(org.id).pipe( + Effect.catchCause(() => Effect.succeed({ used: 0, granted: 0, unlimited: false })), + ); + + const memberships = yield* workos + .listOrgMembers(org.id) + .pipe(Effect.catchTag("WorkOSError", toAccountError)); + + const members = yield* Effect.all( + memberships.data.map((m) => + Effect.gen(function* () { + const user = yield* workos.getUser(m.userId); + return { + id: m.id, + userId: m.userId, + email: user.email, + name: [user.firstName, user.lastName].filter(Boolean).join(" ") || null, + avatarUrl: user.profilePictureUrl ?? null, + role: m.role?.slug ?? "member", + status: m.status, + lastActiveAt: user.lastSignInAt ?? null, + isCurrentUser: m.userId === session.accountId, + }; + }), + ), + { concurrency: 5 }, + ).pipe(Effect.catchTag("WorkOSError", toAccountError)); + + return { members, seats }; + }), + + listRoles: () => + Effect.gen(function* () { + const { org } = yield* requireOrganization(); + const result = yield* workos + .listOrgRoles(org.id) + .pipe(Effect.catchTag("WorkOSError", toAccountError)); + return { + roles: result.data.map((r) => ({ slug: r.slug, name: r.name })), + }; + }), + + inviteMember: (_headers, body) => + Effect.gen(function* () { + const { session, org } = yield* requireOrganization(); + yield* requireAdmin(session.accountId, org.id); + yield* reserveMemberSlot(org.id); + const invitation = yield* workos + .sendInvitation({ + email: body.email, + organizationId: org.id, + ...(body.roleSlug ? { roleSlug: body.roleSlug } : {}), + }) + .pipe(Effect.catchTag("WorkOSError", toAccountError)); + return { id: invitation.id, email: invitation.email }; + }), + + removeMember: (_headers, membershipId) => + Effect.gen(function* () { + const { session, org } = yield* requireOrganization(); + yield* requireAdmin(session.accountId, org.id); + yield* assertMembershipInOrg(org.id, membershipId); + yield* workos + .deleteOrgMembership(membershipId) + .pipe(Effect.catchTag("WorkOSError", toAccountError)); + return { success: true }; + }), + + updateMemberRole: (_headers, membershipId, roleSlug) => + Effect.gen(function* () { + const { session, org } = yield* requireOrganization(); + yield* requireAdmin(session.accountId, org.id); + yield* assertMembershipInOrg(org.id, membershipId); + yield* workos + .updateOrgMembershipRole(membershipId, roleSlug) + .pipe(Effect.catchTag("WorkOSError", toAccountError)); + return { success: true }; + }), + + updateOrgName: (_headers, name) => + Effect.gen(function* () { + const { session, org } = yield* requireOrganization(); + yield* requireAdmin(session.accountId, org.id); + const updated = yield* workos + .updateOrganization(org.id, name) + .pipe(Effect.catchTag("WorkOSError", toAccountError)); + yield* users + .use((s) => s.upsertOrganization({ id: updated.id, name: updated.name })) + .pipe(Effect.catchTag("UserStoreError", toAccountError)); + return { name: updated.name }; + }), + } satisfies AccountProvider["Service"]); + }), +); diff --git a/apps/cloud/src/api.request-scope.node.test.ts b/apps/cloud/src/api.request-scope.node.test.ts index 55f6ddba5..e7e9e54ca 100644 --- a/apps/cloud/src/api.request-scope.node.test.ts +++ b/apps/cloud/src/api.request-scope.node.test.ts @@ -25,8 +25,9 @@ import { describe, it, expect } from "@effect/vitest"; import { Context, Effect, Layer } from "effect"; import { HttpRouter, HttpServer, HttpServerResponse } from "effect/unstable/http"; +import { requestScopedMiddleware } from "@executor-js/api/server"; + import { RequestScopedServicesLive } from "./api/layers"; -import { requestScopedMiddleware } from "./api/request-scoped"; import { makeApiLive } from "./api/router"; class Counter extends Context.Service()("test/Counter") {} diff --git a/apps/cloud/src/api.test.ts b/apps/cloud/src/api.test.ts index db79fd37e..d30785055 100644 --- a/apps/cloud/src/api.test.ts +++ b/apps/cloud/src/api.test.ts @@ -16,6 +16,7 @@ import { } from "effect/unstable/http"; import { expect, layer } from "@effect/vitest"; import { Cause, Effect, Layer, Schema } from "effect"; +import { RouterConfigLive } from "@executor-js/api/server"; import { toErrorServerResponse } from "./api/error-response"; const SourceResponse = Schema.Struct({ source: Schema.String }); @@ -115,8 +116,6 @@ const TestProtectedGate = HttpRouter.middleware()((httpEffect) => // Wire test APIs as route layers + autumn route, mirroring prod's structure. // --------------------------------------------------------------------------- -const RouterConfig = Layer.succeed(HttpRouter.RouterConfig)({ maxParamLength: 1000 }); - const OrgTestLive = HttpApiBuilder.layer(OrgTestApi).pipe(Layer.provide(OrgTestHandlers)); const AuthTestLive = HttpApiBuilder.layer(AuthTestApi).pipe(Layer.provide(AuthHandlers)); const ProtectedTestLive = HttpApiBuilder.layer(ProtectedTestApi).pipe( @@ -145,7 +144,7 @@ const TestApiLive = Layer.mergeAll( TestDocsLive, ProtectedTestLive, AutumnTestRoutesLive, -).pipe(Layer.provideMerge(RouterConfig), Layer.provideMerge(HttpServer.layerServices)); +).pipe(Layer.provideMerge(RouterConfigLive), Layer.provideMerge(HttpServer.layerServices)); const requestHandler = HttpRouter.toWebHandler(TestApiLive, { disableLogger: true }).handler; diff --git a/apps/cloud/src/api.ts b/apps/cloud/src/api.ts deleted file mode 100644 index 7e1293384..000000000 --- a/apps/cloud/src/api.ts +++ /dev/null @@ -1,5 +0,0 @@ -import { HttpRouter } from "effect/unstable/http"; - -import { ApiLive } from "./api/router"; - -export const handleApiRequest = HttpRouter.toWebHandler(ApiLive).handler; diff --git a/apps/cloud/src/api/autumn.ts b/apps/cloud/src/api/autumn.ts index 25bca4ecc..584f9e7fb 100644 --- a/apps/cloud/src/api/autumn.ts +++ b/apps/cloud/src/api/autumn.ts @@ -3,7 +3,7 @@ import { Cause, Effect } from "effect"; import { HttpRouter, HttpServerRequest, HttpServerResponse } from "effect/unstable/http"; import { autumnHandler } from "autumn-js/backend"; -import { WorkOSAuth } from "../auth/workos"; +import { WorkOSClient } from "../auth/workos"; import { HttpResponseError, isServerError, toErrorServerResponse } from "./error-response"; const handler = Effect.gen(function* () { @@ -18,7 +18,7 @@ const handler = Effect.gen(function* () { }), ); - const workos = yield* WorkOSAuth; + const workos = yield* WorkOSClient; const session = yield* workos.authenticateRequest(webRequest); if (!session || !session.organizationId) { @@ -58,7 +58,7 @@ const handler = Effect.gen(function* () { clientOptions: { secretKey: env.AUTUMN_SECRET_KEY ?? "", }, - pathPrefix: "/autumn", + pathPrefix: "/api/autumn", }), ); @@ -81,4 +81,4 @@ const handler = Effect.gen(function* () { }), ); -export const AutumnRoutesLive = HttpRouter.add("*", "/autumn/*", handler); +export const AutumnRoutesLive = HttpRouter.add("*", "/api/autumn/*", handler); diff --git a/apps/cloud/src/api/cloud-plugins.ts b/apps/cloud/src/api/cloud-plugins.ts index c4f006e0e..83e487490 100644 --- a/apps/cloud/src/api/cloud-plugins.ts +++ b/apps/cloud/src/api/cloud-plugins.ts @@ -4,7 +4,7 @@ // module-eval time without runtime credentials: the heavy per-request // dependencies (WorkOS Vault credentials, vault HTTP client) are only // consumed when the plugin's extension is actually constructed inside -// `createScopedExecutor`. Both the API composition (`protected-layers.ts`) +// `createScopedExecutor`. Both the API composition (`layers.ts`) // and the per-request middleware (`protected.ts` + the test harness) // derive their typed views — `composePluginApi(cloudPlugins)`, // `composePluginHandlerLayer(cloudPlugins)`, diff --git a/apps/cloud/src/api/core-shared-services.ts b/apps/cloud/src/api/core-shared-services.ts index 2aa3bc681..627544eca 100644 --- a/apps/cloud/src/api/core-shared-services.ts +++ b/apps/cloud/src/api/core-shared-services.ts @@ -1,25 +1,28 @@ -// --------------------------------------------------------------------------- -// Core shared services — the Effect layer that both the stateless HTTP -// request path and the long-lived MCP session DO build on top of. -// --------------------------------------------------------------------------- +// Isolated leaf: the one neutral boot-scoped service (WorkOSClient) the MCP +// session DO and the miniflare test-worker both build on. This is the neutral +// DB/tracer core — it names NO billing service, so the DO (which never bills) +// does not transitively require one. Billing (`AutumnService`) is provided ONLY +// where it runs: the metered executor plane, the account seat-gate, the +// createOrganization free-limit gate, and the org domain-verification gate. // -// Pulled out of `./layers.ts` so importers that only need `WorkOSAuth` and -// `AutumnService` (notably the MCP session DO) don't have to drag in -// `auth/handlers.ts`, which imports `@tanstack/react-start/server`. That -// import uses a subpath specifier (`#tanstack-start-entry`) that vitest's -// workerd pool can't resolve, so any test that touches the DO through -// SELF.fetch would fail at module load. -// --------------------------------------------------------------------------- +// Kept out of `./layers.ts` ON PURPOSE — this is the one file split the +// readability cleanup deliberately keeps. `./layers.ts` imports +// `auth/handlers.ts`, which imports `@tanstack/react-start/server`. The cloud +// production bundle resolves that chain through the TanStack Start Vite plugin, +// and the workerd vitest pool resolves the `#tanstack-*` subpath specifiers via +// `vitest.config.ts`'s `resolve.alias`. But the MCP DO test-worker is bundled +// by wrangler/esbuild (`mcp-miniflare.e2e.node.test.ts`'s `unstable_dev`), +// which has no alias hook AND can't supply Start's `tanstack-start-*:v` virtual +// modules — so it fails to bundle any module that transitively imports +// react-start. Importing `CoreSharedServices` from here keeps the DO bundle +// react-start-free. -import { Layer } from "effect"; - -import { WorkOSAuth } from "../auth/workos"; -import { AutumnService } from "../services/autumn"; +import { WorkOSClient } from "../auth/workos"; /** - * Services that are independent of how the DB or tracer is provisioned — - * both the stateless HTTP path (per-request DB via Hyperdrive) and the MCP - * session DO (long-lived DB + isolate-local tracer SDK) merge this with - * their own `DbLive` + `UserStoreLive` + telemetry layer. + * The neutral boot-scoped service, independent of how the DB or tracer is + * provisioned — both the stateless HTTP path (per-request DB via Hyperdrive) + * and the MCP session DO (long-lived DB + isolate-local tracer SDK) merge this + * with their own `DbLive` + `UserStoreLive` + telemetry layer. */ -export const CoreSharedServices = Layer.mergeAll(WorkOSAuth.Default, AutumnService.Default); +export const CoreSharedServices = WorkOSClient.Default; diff --git a/apps/cloud/src/api/docs.ts b/apps/cloud/src/api/docs.ts index ba3729c81..4ab7b87bd 100644 --- a/apps/cloud/src/api/docs.ts +++ b/apps/cloud/src/api/docs.ts @@ -5,7 +5,7 @@ import { HttpApiSwagger, OpenApi } from "effect/unstable/httpapi"; import { CloudAuthApi, CloudAuthPublicApi } from "../auth/api"; import { OrgApi } from "../org/api"; -import { ProtectedCloudApi } from "./protected-layers"; +import { ProtectedCloudApi } from "./layers"; export const CloudOpenApi = ProtectedCloudApi.add(CloudAuthPublicApi).add(CloudAuthApi).add(OrgApi); diff --git a/apps/cloud/src/api/execution-stack-metered.ts b/apps/cloud/src/api/execution-stack-metered.ts new file mode 100644 index 000000000..18ba69aec --- /dev/null +++ b/apps/cloud/src/api/execution-stack-metered.ts @@ -0,0 +1,54 @@ +// --------------------------------------------------------------------------- +// Metered execution stack — the HTTP executor plane's billing overlay. +// +// Cloud is the only host that meters executions, and only the HTTP `/api/*` +// executor plane does so (the MCP session DO never bills). This module is where +// the billing decorator binds to the neutral `CloudExecutionStackLayer`: it +// overrides the base stack's no-op `EngineDecorator` with one that calls +// `AutumnService.trackExecution` after each execution. +// +// Keeping this in the cloud APP layer (not the neutral `services/execution-stack.ts`) +// is the billing-boundary line: the neutral stack the DO shares names no billing +// service; the metered overlay — provided ONLY here — does. +// --------------------------------------------------------------------------- + +import { Effect, Layer } from "effect"; + +import { + CodeExecutorProvider, + DbProvider, + EngineDecorator, + HostConfig, + PluginsProvider, + type EngineStackIdentity, +} from "@executor-js/api/server"; + +import { AutumnService } from "../services/autumn"; +import type { DbService } from "../services/db"; +import { CloudExecutionSeamsLayer } from "../services/execution-stack"; +import { withExecutionUsageTracking } from "./execution-usage"; + +// Usage-metering decorator bound to the billing service. `trackExecution` is +// fire-and-forget (`Effect.runFork`) so the billing call can't stall a +// user-facing execution. +export const CloudMeteringEngineDecorator: Layer.Layer = + Layer.effect(EngineDecorator)( + Effect.map(AutumnService.asEffect(), (autumn): EngineDecorator["Service"] => ({ + decorate: (engine, identity: EngineStackIdentity) => + withExecutionUsageTracking(identity.organizationId, engine, (organizationId) => + Effect.runFork(autumn.trackExecution(organizationId)), + ), + })), + ); + +/** + * The execution-stack seams for the metered HTTP executor plane: the four + * billing-free `CloudExecutionSeamsLayer` seams plus the billing decorator. + * Requires `DbService` (per-request Hyperdrive db) and `AutumnService` (usage + * metering) from the surrounding context. + */ +export const CloudMeteredExecutionStackLayer: Layer.Layer< + DbProvider | PluginsProvider | HostConfig | CodeExecutorProvider | EngineDecorator, + never, + AutumnService | DbService +> = Layer.merge(CloudExecutionSeamsLayer, CloudMeteringEngineDecorator); diff --git a/apps/cloud/src/api/extension-routes.ts b/apps/cloud/src/api/extension-routes.ts new file mode 100644 index 000000000..1486a611e --- /dev/null +++ b/apps/cloud/src/api/extension-routes.ts @@ -0,0 +1,98 @@ +// --------------------------------------------------------------------------- +// Cloud's app-only HTTP surface — the `extensions.routes` fed to +// `ExecutorApp.make`. None of these are seams the shared core names; they are +// cloud-specific routes mounted alongside the executor `/api/*` plane: +// +// - the WorkOS session routes (login / callback / me / organizations / +// switch-organization / invitations / MCP-approval) — `NonProtectedApi`. +// - the cloud-only WorkOS domain-verification routes — `OrgHttpApi`. +// - Swagger UI + the OpenAPI JSON for the full cloud spec. +// - the Autumn billing proxy (`/api/autumn/*`) — billing-as-extension. +// - the global request-failure logging middleware. +// +// They all serve UNDER the `/api` prefix (the same namespace the protected + +// account APIs use), so each HttpApi group is provided the shared +// `apiPrefixedRouter` view; the plain `HttpRouter.add` routes use literal +// `/api/...` paths. The per-request `DbService` / `UserStoreService` the session +// handlers read is supplied by `RequestScopedServicesLive` (rebuilt per request +// so the postgres.js socket lives in the request fiber's scope). +// --------------------------------------------------------------------------- + +import { Effect, Layer } from "effect"; +import { HttpRouter, HttpServerResponse } from "effect/unstable/http"; +import { HttpApiBuilder } from "effect/unstable/httpapi"; +import { HttpApiSwagger, OpenApi } from "effect/unstable/httpapi"; + +import { requestScopedMiddleware } from "@executor-js/api/server"; + +import { UserStoreService } from "../auth/context"; +import { + CloudAuthPublicHandlers, + CloudSessionAuthHandlers, + NonProtectedApi, +} from "../auth/handlers"; +import { CloudAuthApi, CloudAuthPublicApi } from "../auth/api"; +import { OrgAuthLive, SessionAuthLive } from "../auth/middleware-live"; +import { OrgApi, OrgHttpApi } from "../org/api"; +import { OrgHandlers } from "../org/handlers"; +import { AutumnService } from "../services/autumn"; +import { DbService } from "../services/db"; +import { ProtectedCloudApi } from "./layers"; +import { AutumnRoutesLive } from "./autumn"; +import { ApiErrorLoggingLive } from "./error-logging"; + +// The `/api`-prefixed `HttpRouter` view every cloud HttpApi group registers on, +// so `/auth/me` serves at `/api/auth/me` (matching the protected + account +// plane). Derived from the ambient router, exactly as `ExecutorApp.make` builds +// its own internal prefixed view for the protected API. +const apiPrefixedRouter = Layer.effect(HttpRouter.HttpRouter)( + Effect.map(HttpRouter.HttpRouter.asEffect(), (router) => router.prefixed("/api")), +); + +// The full cloud OpenAPI spec, prefixed so the served paths match `/api/*`. +const CloudOpenApi = ProtectedCloudApi.add(CloudAuthPublicApi) + .add(CloudAuthApi) + .add(OrgApi) + .prefix("/api"); + +const spec = OpenApi.fromApi(CloudOpenApi); + +/** + * Build cloud's app-only extension routes. `rsLive` is the per-request DB layer + * the session handlers read; passed in so tests can swap a counting fake. + * + * `AutumnService.Default` is provided to the session + org groups because the + * `createOrganization` free-limit gate and the domain-verification-link gate + * read it — the few app-only billing touchpoints. It is NOT on the neutral boot + * core. + */ +export const makeCloudExtensionRoutes = (rsLive: Layer.Layer) => { + // Session routes (login / callback / me / switch-org / …). Handlers yield + // `UserStoreService` directly; the per-request DB combine keeps the postgres + // socket request-scoped. + const SessionRoutes = HttpApiBuilder.layer(NonProtectedApi).pipe( + Layer.provide(Layer.mergeAll(CloudAuthPublicHandlers, CloudSessionAuthHandlers)), + Layer.provide(requestScopedMiddleware(rsLive).layer), + Layer.provideMerge(SessionAuthLive), + Layer.provideMerge(AutumnService.Default), + Layer.provide(apiPrefixedRouter), + ); + + // Cloud-only WorkOS domain-verification routes; `OrgAuth` enforces an + // authenticated org session. No per-request DB scoping needed. + const OrgRoutes = HttpApiBuilder.layer(OrgHttpApi).pipe( + Layer.provide(OrgHandlers), + Layer.provideMerge(OrgAuthLive), + Layer.provideMerge(AutumnService.Default), + Layer.provide(apiPrefixedRouter), + ); + + // Swagger UI at /api/docs + the OpenAPI JSON at /api/openapi.json, over the + // `/api`-prefixed spec (so the served paths match). + const DocsRoutes = Layer.mergeAll( + HttpApiSwagger.layer(CloudOpenApi, { path: "/api/docs" }), + HttpRouter.add("GET", "/api/openapi.json", Effect.succeed(HttpServerResponse.jsonUnsafe(spec))), + ); + + return [SessionRoutes, OrgRoutes, DocsRoutes, AutumnRoutesLive, ApiErrorLoggingLive] as const; +}; diff --git a/apps/cloud/src/api/layers.ts b/apps/cloud/src/api/layers.ts index fb6abdf4b..ae7f32856 100644 --- a/apps/cloud/src/api/layers.ts +++ b/apps/cloud/src/api/layers.ts @@ -2,8 +2,9 @@ import { HttpApiBuilder } from "effect/unstable/httpapi"; import { HttpServer } from "effect/unstable/http"; import { Layer } from "effect"; +import { makeProtectedApiLayer, requestScopedMiddleware } from "@executor-js/api/server"; + import { OrgAuthLive, SessionAuthLive } from "../auth/middleware-live"; -import { ApiKeyService } from "../auth/api-keys"; import { UserStoreService } from "../auth/context"; import { CloudAuthPublicHandlers, @@ -11,15 +12,15 @@ import { NonProtectedApi, } from "../auth/handlers"; import { DbService } from "../services/db"; -import { TelemetryLive } from "../services/telemetry"; -import { OrgHttpApi } from "../org/compose"; +import { WorkerTelemetryLive } from "../services/telemetry"; +import { OrgHttpApi } from "../org/api"; import { OrgHandlers } from "../org/handlers"; +import { ErrorCaptureLive } from "../observability"; -import { CoreSharedServices } from "./core-shared-services"; -import { ProtectedCloudApi, RouterConfig } from "./protected-layers"; -import { requestScopedMiddleware } from "./request-scoped"; +import { AutumnService } from "../services/autumn"; -export { CoreSharedServices, ProtectedCloudApi, RouterConfig }; +import { cloudPlugins } from "./cloud-plugins"; +import { CoreSharedServices } from "./core-shared-services"; const DbLive = DbService.Live; const UserStoreLive = UserStoreService.Live.pipe(Layer.provide(DbLive)); @@ -36,7 +37,7 @@ export const RequestScopedServicesLive = Layer.mergeAll(DbLive, UserStoreLive); export const BootSharedServices = Layer.mergeAll( CoreSharedServices, HttpServer.layerServices, - TelemetryLive, + WorkerTelemetryLive, ); // Routes that don't require an authenticated org session — login, @@ -48,25 +49,70 @@ export const BootSharedServices = Layer.mergeAll( // without per-request scoping the postgres.js socket pins to the worker's // boot scope and Cloudflare Workers' I/O isolation kills the second // request. +// +// `AutumnService.Default` is provided HERE because the `createOrganization` +// handler reads it for the free-organizations-per-user limit gate — one of the +// few app-only billing touchpoints. (It is NOT on the neutral boot core.) export const makeNonProtectedApiLive = (rsLive: Layer.Layer) => HttpApiBuilder.layer(NonProtectedApi).pipe( Layer.provide(Layer.mergeAll(CloudAuthPublicHandlers, CloudSessionAuthHandlers)), - Layer.provideMerge(ApiKeyService.WorkOS), Layer.provide(requestScopedMiddleware(rsLive).layer), Layer.provideMerge(SessionAuthLive), + Layer.provideMerge(AutumnService.Default), ); -// Routes scoped to a specific org (membership management, switching, etc.). -// Auth is enforced by `OrgAuth` middleware declared on `OrgHttpApi`. -export const makeOrgApiLive = (rsLive: Layer.Layer) => - HttpApiBuilder.layer(OrgHttpApi).pipe( - Layer.provide(OrgHandlers), - Layer.provide(requestScopedMiddleware(rsLive).layer), - Layer.provideMerge(OrgAuthLive), - ); +// Cloud-only WorkOS domain-verification routes. Auth is enforced by `OrgAuth` +// middleware declared on `OrgHttpApi`. The domain handlers read the boot +// `WorkOSClient` plus the `AuthContext` from `OrgAuthLive`; the +// `getDomainVerificationLink` handler also gates on billing, so +// `AutumnService.Default` is provided HERE (not on the neutral boot core). +// Unlike the member endpoints that used to live here, they need no per-request +// DB scoping. +export const OrgApiLive = HttpApiBuilder.layer(OrgHttpApi).pipe( + Layer.provide(OrgHandlers), + Layer.provideMerge(OrgAuthLive), + Layer.provideMerge(AutumnService.Default), +); -// Default exports use the production per-request layer. Existing callers -// that import `NonProtectedApiLive`/`OrgApiLive` continue to work; the -// `make*` factories exist for tests that need to swap in a fake. +// Default export uses the production per-request layer. Existing callers that +// import `NonProtectedApiLive` continue to work; the `make*` factory exists for +// tests that need to swap in a fake. export const NonProtectedApiLive = makeNonProtectedApiLive(RequestScopedServicesLive); -export const OrgApiLive = makeOrgApiLive(RequestScopedServicesLive); + +// --------------------------------------------------------------------------- +// Protected API +// --------------------------------------------------------------------------- +// +// `ProtectedCloudApi` deliberately does NOT declare `.middleware(OrgAuth)` +// — auth + per-request execution stack construction live in a single +// `HttpRouter` middleware (`ExecutionStackMiddleware` in `./protected.ts`) +// which has the right ordering to provide `AuthContext` AND the executor +// services to handlers. Putting auth on the API as `HttpApiMiddleware` ran +// it INSIDE the router middleware (wrong order), and added a second auth +// pass on top of the existing one in `protected.ts`'s outer effect. The +// router-middleware approach folds both into one place. +// +// The shared `makeProtectedApiLayer` assembles the protected API the same way +// every host does: `composePluginApi(cloudPlugins)` -> +// `observabilityMiddleware` -> `HttpApiBuilder.layer` provided with +// `CoreHandlers` + `composePluginHandlerLayer(cloudPlugins)` + the host's +// `ErrorCapture` + `RouterConfigLive`. Cloud serves at root (no prefixed +// router) and passes the Sentry-backed `ErrorCaptureLive` (provided ABOVE the +// handler + middleware layers, so the `capture(...)` translation path AND the +// observability middleware's defect catchall both resolve the same Sentry +// implementation). +// +// `api` is precisely typed (`HttpApi<…, CoreGroups | PluginGroups>`); test harness clients type via +// `HttpApiClient.ForApi` with no per-plugin imports. +// `handlers` is the late-binding plugin handler Layer (each plugin's +// `extensionService` Tag stays a requirement, satisfied per-request by +// `ExecutionStackMiddleware` in `./protected.ts`). `RouterConfigLive` is +// folded into `.layer` here; the rest of the router (`makeApiLive` in +// `./router.ts`, `./protected.ts`, the test harness) re-provides the same +// shared `RouterConfigLive` directly. +const protectedApi = makeProtectedApiLayer(cloudPlugins, { errorCapture: ErrorCaptureLive }); + +export const ProtectedCloudApi = protectedApi.api; +export const ProtectedCloudApiHandlers = protectedApi.handlers; +export const ProtectedCloudApiLive = protectedApi.layer; diff --git a/apps/cloud/src/api/protected-api-key-auth.node.test.ts b/apps/cloud/src/api/protected-api-key-auth.node.test.ts index 8e5278f92..a74764b61 100644 --- a/apps/cloud/src/api/protected-api-key-auth.node.test.ts +++ b/apps/cloud/src/api/protected-api-key-auth.node.test.ts @@ -3,8 +3,8 @@ import { Effect, Layer } from "effect"; import { ApiKeyService } from "../auth/api-keys"; import { UserStoreService } from "../auth/context"; -import { WorkOSAuth, type WorkOSAuthService } from "../auth/workos"; -import { resolveProtectedIdentity } from "./protected"; +import { WorkOSClient, type WorkOSClientService } from "../auth/workos"; +import { resolveProtectedPrincipal } from "./protected"; const createdAt = new Date("2026-01-01T00:00:00.000Z"); @@ -25,8 +25,8 @@ const stubApiKeys = Layer.succeed(ApiKeyService)({ }); const stubWorkOS = Layer.succeed( - WorkOSAuth, - new Proxy({} as WorkOSAuthService, { + WorkOSClient, + new Proxy({} as WorkOSClientService, { get: (_target, prop) => { if (prop === "listUserMemberships") { return (userId: string) => @@ -37,7 +37,7 @@ const stubWorkOS = Layer.succeed( : [], }); } - return () => Effect.die(`unexpected WorkOSAuth.${String(prop)} call`); + return () => Effect.die(`unexpected WorkOSClient.${String(prop)} call`); }, }), ); @@ -52,13 +52,17 @@ const stubUsers = Layer.succeed(UserStoreService)({ ...org, createdAt, }), - getOrganization: async (id: string) => ({ id, name: `Org ${id}`, createdAt }), + getOrganization: async (id: string) => ({ + id, + name: `Org ${id}`, + createdAt, + }), }), ), }); const run = (request: Request) => - resolveProtectedIdentity(request).pipe( + resolveProtectedPrincipal(request).pipe( Effect.provide(Layer.mergeAll(stubApiKeys, stubWorkOS, stubUsers)), ); @@ -78,6 +82,7 @@ describe("protected API key auth", () => { email: "", name: null, avatarUrl: null, + roles: [], }); }), ); @@ -92,9 +97,13 @@ describe("protected API key auth", () => { ), ); + // The resolver now raises the SHARED `Unauthorized` carrying the same + // machine code; cloud's failure strategy renders it as the byte-identical + // 401 `{ error: "Invalid API key", code: "invalid_api_key" }`. expect(error).toMatchObject({ - status: 401, + _tag: "Unauthorized", code: "invalid_api_key", + message: "Invalid API key", }); }), ); diff --git a/apps/cloud/src/api/protected-layers.ts b/apps/cloud/src/api/protected-layers.ts deleted file mode 100644 index 5683f5574..000000000 --- a/apps/cloud/src/api/protected-layers.ts +++ /dev/null @@ -1,68 +0,0 @@ -// Protected-side API wiring. Kept separate from `./layers.ts` so tests -// can import the protected API + shared services without dragging in -// non-protected/org handlers (which transitively import -// `@tanstack/react-start`, unresolvable in the Workers test runtime). - -import { HttpApiBuilder } from "effect/unstable/httpapi"; -import { HttpRouter, HttpServer } from "effect/unstable/http"; -import { Layer } from "effect"; - -import { observabilityMiddleware } from "@executor-js/api"; -import { CoreHandlers, composePluginApi, composePluginHandlerLayer } from "@executor-js/api/server"; - -import { cloudPlugins } from "./cloud-plugins"; -import { UserStoreService } from "../auth/context"; -import { WorkOSAuth } from "../auth/workos"; -import { AutumnService } from "../services/autumn"; -import { DbService } from "../services/db"; -import { ErrorCaptureLive } from "../observability"; - -// `ProtectedCloudApi` deliberately does NOT declare `.middleware(OrgAuth)` -// — auth + per-request execution stack construction live in a single -// `HttpRouter` middleware (`ExecutionStackMiddleware` in `./protected.ts`) -// which has the right ordering to provide `AuthContext` AND the executor -// services to handlers. Putting auth on the API as `HttpApiMiddleware` ran -// it INSIDE the router middleware (wrong order), and added a second auth -// pass on top of the existing one in `protected.ts`'s outer effect. The -// router-middleware approach folds both into one place. -// -// `composePluginApi(cloudPlugins)` returns a precisely typed `HttpApi` -// — the group union is derived from `typeof cloudPlugins` via the -// plugin spec's `TGroup` generic. Test harness clients type via -// `HttpApiClient.ForApi` directly, with no -// per-plugin Group imports at the host. -export const ProtectedCloudApi = composePluginApi(cloudPlugins); - -const ObservabilityLive = observabilityMiddleware(ProtectedCloudApi); - -const DbLive = DbService.Live; -const UserStoreLive = UserStoreService.Live.pipe(Layer.provide(DbLive)); - -export const SharedServices = Layer.mergeAll( - DbLive, - UserStoreLive, - WorkOSAuth.Default, - AutumnService.Default, - HttpServer.layerServices, -); - -export const RouterConfig = Layer.succeed(HttpRouter.RouterConfig)({ maxParamLength: 1000 }); - -// Every handler the ProtectedCloudApi routes to. Plugin handler layers -// are late-binding — they require their plugin's `extensionService` -// Tag, which the per-request `ExecutionStackMiddleware` satisfies via -// `providePluginExtensions`. The test harness mirrors this; nothing -// else needs to know which plugins are wired. -export const ProtectedCloudApiHandlers = Layer.mergeAll( - CoreHandlers, - composePluginHandlerLayer(cloudPlugins), -); - -// `ErrorCaptureLive` is provided above the handler + middleware layers -// so the `withCapture` translation path (typed-channel `StorageError → -// InternalError(traceId)`) AND the observability middleware's defect -// catchall both see the same Sentry-backed implementation. -export const ProtectedCloudApiLive = HttpApiBuilder.layer(ProtectedCloudApi).pipe( - Layer.provide(Layer.mergeAll(ProtectedCloudApiHandlers, ObservabilityLive)), - Layer.provide(ErrorCaptureLive), -); diff --git a/apps/cloud/src/api/protected.test.ts b/apps/cloud/src/api/protected.test.ts index d6ff28874..66595f5ec 100644 --- a/apps/cloud/src/api/protected.test.ts +++ b/apps/cloud/src/api/protected.test.ts @@ -24,8 +24,8 @@ describe("withExecutionUsageTracking", () => { it.effect("tracks successful execute and executeWithPause", () => Effect.gen(function* () { const tracked: string[] = []; - const engine = withExecutionUsageTracking("org_1", makeBaseEngine(), (orgId) => { - tracked.push(orgId); + const engine = withExecutionUsageTracking("org_1", makeBaseEngine(), (organizationId) => { + tracked.push(organizationId); }); yield* engine.execute("1+1", { onElicitation: () => Effect.die("unused") }); @@ -50,8 +50,8 @@ describe("withExecutionUsageTracking", () => { return base.resume(...args); }, }, - (orgId) => { - tracked.push(orgId); + (organizationId) => { + tracked.push(organizationId); }, ); diff --git a/apps/cloud/src/api/protected.ts b/apps/cloud/src/api/protected.ts index 07f426513..47022427e 100644 --- a/apps/cloud/src/api/protected.ts +++ b/apps/cloud/src/api/protected.ts @@ -1,212 +1,123 @@ -// Production wiring for the protected API. Lives outside `protected-layers.ts` -// because `makeExecutionStack` imports `cloudflare:workers`, which the test -// harness can't load in the workerd test runtime. +// Production wiring for the protected API: the per-request HttpRouter +// middleware that resolves identity, builds the executor/engine, and provides +// `AuthContext` + the execution-stack services to handlers. -import { HttpRouter, HttpServerRequest } from "effect/unstable/http"; import { Effect, Layer } from "effect"; import { - ExecutionEngineService, - ExecutorService, - providePluginExtensions, - type PluginExtensionServices, + IdentityProvider, + makeExecutionStackMiddleware, + requestScopedMiddleware, + RouterConfigLive, + type IdentityFailure, } from "@executor-js/api/server"; import { cloudPlugins, type CloudPlugins } from "./cloud-plugins"; -import { AuthContext } from "../auth/middleware"; import { ApiKeyService } from "../auth/api-keys"; -import { authorizeOrganization } from "../auth/authorize-organization"; import { UserStoreService } from "../auth/context"; -import { WorkOSAuth } from "../auth/workos"; +import { cloudIdentityFailureStrategy, workosIdentityLayer } from "../auth/workos-auth-provider"; import { AutumnService } from "../services/autumn"; import { DbService } from "../services/db"; -import { makeExecutionStack } from "../services/execution-stack"; -import { HttpResponseError } from "./error-response"; -import { RequestScopedServicesLive } from "./layers"; -import { ProtectedCloudApiLive, RouterConfig } from "./protected-layers"; -import { requestScopedMiddleware } from "./request-scoped"; - -// Pre-compute the per-plugin `Effect.provideService(extensionService, -// executor[id])` chain. The plugin spec carries the Service tag so -// this file doesn't import each plugin's `*/api` directly. -const provideExecutorExtensions = providePluginExtensions(cloudPlugins); -const BEARER_PREFIX = "Bearer "; - -export const resolveApiKeyIdentity = (request: Request) => - Effect.gen(function* () { - const authHeader = request.headers.get("authorization"); - if (!authHeader) return null; - - if (!authHeader.startsWith(BEARER_PREFIX)) { - return yield* new HttpResponseError({ - status: 401, - code: "invalid_authorization_header", - message: "Authorization header must use Bearer authentication", - }); - } - - const value = authHeader.slice(BEARER_PREFIX.length).trim(); - if (!value) { - return yield* new HttpResponseError({ - status: 401, - code: "invalid_api_key", - message: "Invalid API key", - }); - } - - const apiKeys = yield* ApiKeyService; - const principal = yield* apiKeys.validate(value).pipe( - Effect.catchTag("ApiKeyValidationError", () => - Effect.fail( - new HttpResponseError({ - status: 503, - code: "api_key_validation_unavailable", - message: "API key validation is temporarily unavailable", - }), - ), - ), - ); - - if (!principal) { - return yield* new HttpResponseError({ - status: 401, - code: "invalid_api_key", - message: "Invalid API key", - }); - } - - const org = yield* authorizeOrganization(principal.accountId, principal.organizationId); - if (!org) { - return yield* new HttpResponseError({ - status: 403, - code: "no_organization", - message: "No organization in API key", - }); - } - - return { - accountId: principal.accountId, - organizationId: org.id, - organizationName: org.name, - email: "", - name: null, - avatarUrl: null, - }; - }); - -export const resolveSessionIdentity = (request: Request) => - Effect.gen(function* () { - const workos = yield* WorkOSAuth; - const session = yield* workos.authenticateRequest(request); - if (!session || !session.organizationId) { - return yield* new HttpResponseError({ - status: 403, - code: "no_organization", - message: "No organization in session", - }); - } - const org = yield* authorizeOrganization(session.userId, session.organizationId); - if (!org) { - return yield* new HttpResponseError({ - status: 403, - code: "no_organization", - message: "No organization in session", - }); - } - return { - accountId: session.userId, - organizationId: org.id, - organizationName: org.name, - email: session.email, - name: `${session.firstName ?? ""} ${session.lastName ?? ""}`.trim() || null, - avatarUrl: session.avatarUrl ?? null, - }; - }); - -export const resolveProtectedIdentity = (request: Request) => - Effect.gen(function* () { - const apiKeyIdentity = yield* resolveApiKeyIdentity(request); - if (apiKeyIdentity) return apiKeyIdentity; - return yield* resolveSessionIdentity(request); - }); +import { CoreSharedServices } from "./core-shared-services"; +import { CloudMeteredExecutionStackLayer } from "./execution-stack-metered"; +import { ProtectedCloudApiLive, RequestScopedServicesLive } from "./layers"; + +// Re-exported for `protected-api-key-auth.node.test.ts`, which asserts the +// per-path principal + error codes the folded resolver still produces. +export { + resolveApiKeyPrincipal, + resolveSessionPrincipal, + resolveProtectedPrincipal, +} from "../auth/workos-auth-provider"; // One `HttpRouter` middleware that: -// 1. authenticates the WorkOS sealed session, -// 2. verifies live org membership (closes the JWT-cache gap — see -// `auth/authorize-organization.ts`), -// 3. resolves the org name, -// 4. builds the per-request executor + engine, -// 5. provides `AuthContext` + the execution-stack services to the handler. +// 1. resolves identity via the NEUTRAL `IdentityProvider` (api-key BEATS sealed +// session, decided INSIDE cloud's `workosIdentityLayer`), verifying live org +// membership, +// 2. builds the per-request executor + engine, +// 3. provides `AuthContext` + the execution-stack services to the handler. // // Replaces both the old outer `Effect.gen` in this file (which did its own // WorkOS lookup) and the per-route `OrgAuth` HttpApiMiddleware (which did // a second one). // -// Errors are NOT caught here: failures propagate as typed errors and are -// rendered to a JSON response by the framework's `Respondable` pipeline -// (see `HttpResponseError` in `./error-response.ts`). Letting `unhandled` -// pass through is what satisfies `HttpRouter.middleware`'s brand check -// without any type casts. +// The shared `makeExecutionStackMiddleware` (P5) owns the body; cloud injects: +// - the neutral `IdentityProvider` -> the identity seam. Cloud's +// `workosIdentityLayer` provides this tag; it +// reads the per-request `UserStoreService`, so +// it is built PER REQUEST in the DB combine +// below (NOT captured at boot). +// - `cloudIdentityFailureStrategy` -> renders the shared identity errors as +// cloud's exact `{ error, code }` JSON at +// status 401/403/503 (byte-identical). +// - `cloudPlugins` + `CloudMeteredExecutionStackLayer` — the executor plane is +// the ONLY path that meters, so billing lives +// here (not in the neutral stack the DO shares). // -// `DbService` and `UserStoreService` are pulled from per-request context -// — `RequestScopedServicesMiddleware` (combined below) provides them -// fresh per request so the postgres.js socket lives in the request -// fiber's scope, not the worker's boot scope. -const ExecutionStackMiddleware = HttpRouter.middleware<{ - // The plugin extension Services this middleware satisfies are derived - // from `typeof cloudPlugins` — no per-plugin `*ExtensionService` - // imports at the host. Runtime binding mirrors the type: - // `providePluginExtensions(cloudPlugins)(executor)` below. - provides: - | AuthContext - | ExecutorService - | ExecutionEngineService - | PluginExtensionServices; -}>()( - Effect.gen(function* () { - const longLived = yield* Effect.context(); - return (httpEffect) => - Effect.gen(function* () { - const request = yield* HttpServerRequest.HttpServerRequest; - const webRequest = yield* HttpServerRequest.toWeb(request); - const identity = yield* resolveProtectedIdentity(webRequest); - const auth = AuthContext.of({ - accountId: identity.accountId, - organizationId: identity.organizationId, - email: identity.email, - name: identity.name, - avatarUrl: identity.avatarUrl, - }); - const { executor, engine } = yield* makeExecutionStack( - auth.accountId, - identity.organizationId, - identity.organizationName, - ); - return yield* httpEffect.pipe( - Effect.provideService(AuthContext, auth), - Effect.provideService(ExecutorService, executor), - Effect.provideService(ExecutionEngineService, engine), - provideExecutorExtensions(executor), - ); - }).pipe(Effect.provideContext(longLived)); - }), -); - -// `rsLive` is the per-request DB layer. Combining it into the auth -// middleware collapses `requires: DbService | UserStoreService` to -// never (so `.layer` is a real Layer instead of the "Need to combine" -// type-error sentinel) AND makes the postgres.js socket request-scoped: -// the layer rebuilds per HTTP request, satisfying Cloudflare Workers' -// I/O isolation. Exposed as a factory so tests can swap in a counting -// fake — see `apps/cloud/src/api.request-scope.node.test.ts`. +// Only `AutumnService` is captured at boot; `IdentityProvider` + `DbService` + +// `UserStoreService` stay residual and are supplied per request by the combined +// `requestScopedMiddleware` (so the postgres.js socket — and the identity layer +// that reads it — live in the request fiber's scope, satisfying Cloudflare +// Workers' I/O isolation). +const ExecutionStackMiddleware = makeExecutionStackMiddleware< + CloudPlugins, + IdentityFailure, + IdentityProvider, + AutumnService | DbService, + never, + // Capture only the boot-scoped `AutumnService`; `IdentityProvider` + `DbService` + // + `UserStoreService` stay residual and flow through the per-request DB combine. + AutumnService +>({ + plugins: cloudPlugins, + authenticate: (request) => + IdentityProvider.asEffect().pipe(Effect.flatMap((provider) => provider.authenticate(request))), + strategy: cloudIdentityFailureStrategy, + stackLayer: CloudMeteredExecutionStackLayer, +}); + +// `rsLive` is the per-request DB layer. `requestScopedLive` folds the neutral +// `IdentityProvider` (cloud's `workosIdentityLayer`, which reads the per-request +// `UserStoreService` from `rsLive` and the boot `WorkOSClient` / `ApiKeyService` +// residually) ON TOP of it, so the identity layer is rebuilt per request in the +// same request-fiber scope as the postgres.js socket it reads — satisfying +// Cloudflare Workers' I/O isolation. Combining it into the auth middleware +// collapses `requires: IdentityProvider | DbService | UserStoreService` to the +// boot-only `WorkOSClient | ApiKeyService` (so `.layer` is a real Layer instead +// of the "Need to combine" sentinel). Exposed as a factory so tests can swap in a +// counting fake — see `apps/cloud/src/api.request-scope.node.test.ts`. +// +// `AutumnService` is provided HERE — the billing service is scoped to the +// executor plane that meters, not to the neutral boot core. (`/autumn`, the +// account seat-gate, and the createOrganization free-limit gate each provide it +// where they run.) export const makeProtectedApiLive = (rsLive: Layer.Layer) => { + // The neutral `IdentityProvider`, built per request: it reads `UserStoreService` + // from `rsLive` and the WorkOS control plane (`WorkOSClient` + `ApiKeyService`, + // stateless config — no per-request I/O socket) for the org-resolution path. + // `orDie` because a WorkOS config error is unrecoverable. + const identityLive = workosIdentityLayer.pipe( + Layer.provide(rsLive), + Layer.provide(ApiKeyService.WorkOS.pipe(Layer.provide(CoreSharedServices))), + Layer.provide(CoreSharedServices), + // oxlint-disable-next-line executor/no-effect-escape-hatch -- boundary: a boot-time WorkOS misconfiguration is unrecoverable + Layer.orDie, + ); + // The per-request layer the combine rebuilds in the request fiber's scope: the + // postgres socket (`rsLive`) PLUS the identity layer that reads it. Combining it + // into the auth middleware collapses `requires: IdentityProvider | DbService | + // UserStoreService` to `never` (so `.layer` is a real Layer instead of the "Need + // to combine" sentinel) AND keeps the socket request-scoped. Exposed as a + // factory so tests can swap in a counting fake — see + // `apps/cloud/src/api.request-scope.node.test.ts`. + const requestScopedLive = rsLive.pipe(Layer.provideMerge(identityLive)); const protectedMiddleware = ExecutionStackMiddleware.combine( - requestScopedMiddleware(rsLive), + requestScopedMiddleware(requestScopedLive), ).layer; return ProtectedCloudApiLive.pipe( Layer.provide(protectedMiddleware), - Layer.provideMerge(ApiKeyService.WorkOS), - Layer.provideMerge(RouterConfig), + Layer.provideMerge(AutumnService.Default), + Layer.provideMerge(RouterConfigLive), ); }; diff --git a/apps/cloud/src/api/router.ts b/apps/cloud/src/api/router.ts index 956d2f718..49cf9004f 100644 --- a/apps/cloud/src/api/router.ts +++ b/apps/cloud/src/api/router.ts @@ -1,17 +1,20 @@ import { Layer } from "effect"; +import { HttpRouter } from "effect/unstable/http"; + +import { RouterConfigLive } from "@executor-js/api/server"; import { UserStoreService } from "../auth/context"; import { DbService } from "../services/db"; +import { makeAccountApiLive } from "../account/account-api"; import { AutumnRoutesLive } from "./autumn"; import { CloudDocsLive } from "./docs"; import { ApiErrorLoggingLive } from "./error-logging"; import { BootSharedServices, + OrgApiLive, RequestScopedServicesLive, - RouterConfig, makeNonProtectedApiLive, - makeOrgApiLive, } from "./layers"; import { makeProtectedApiLive } from "./protected"; @@ -29,11 +32,14 @@ import { makeProtectedApiLive } from "./protected"; export const makeApiLive = (requestScopedLive: Layer.Layer) => Layer.mergeAll( makeNonProtectedApiLive(requestScopedLive), - makeOrgApiLive(requestScopedLive), + OrgApiLive, + makeAccountApiLive(requestScopedLive), CloudDocsLive, makeProtectedApiLive(requestScopedLive), AutumnRoutesLive, ApiErrorLoggingLive, - ).pipe(Layer.provideMerge(RouterConfig), Layer.provideMerge(BootSharedServices)); + ).pipe(Layer.provideMerge(RouterConfigLive), Layer.provideMerge(BootSharedServices)); export const ApiLive = makeApiLive(RequestScopedServicesLive); + +export const handleApiRequest = HttpRouter.toWebHandler(ApiLive).handler; diff --git a/apps/cloud/src/app.ts b/apps/cloud/src/app.ts new file mode 100644 index 000000000..fc42ed6a3 --- /dev/null +++ b/apps/cloud/src/app.ts @@ -0,0 +1,139 @@ +import { Layer } from "effect"; +import { HttpServer } from "effect/unstable/http"; + +import { DbProvider, ExecutorApp } from "@executor-js/api/server"; + +import { cloudPlugins } from "./api/cloud-plugins"; +import { CoreSharedServices } from "./api/core-shared-services"; +import { makeCloudExtensionRoutes } from "./api/extension-routes"; +import { RequestScopedServicesLive } from "./api/layers"; +import { CloudMeteringEngineDecorator } from "./api/execution-stack-metered"; +import { workosAccountMiddleware } from "./account/account-api"; +import { ApiKeyService } from "./auth/api-keys"; +import { cloudIdentityFailureStrategy, workosIdentityLayer } from "./auth/workos-auth-provider"; +import { DbService } from "./services/db"; +import { cloudMcpAuth, cloudMcpReporter, cloudMcpSessions } from "./mcp"; +import { McpSessionDO } from "./mcp/session-durable-object"; +import { ErrorCaptureLive } from "./observability"; +import { AutumnService } from "./services/autumn"; +import { + CloudCodeExecutorProvider, + CloudDbProvider, + CloudHostConfig, + CloudPluginsProvider, +} from "./services/execution-stack"; +import { WorkerTelemetryLive } from "./services/telemetry"; + +// =========================================================================== +// The Executor CLOUD app, as ONE `ExecutorApp.make` call. +// +// The whole scenario in 60 seconds: WorkOS identity (api-key Bearer OR sealed- +// session cookie, api-key wins) over a per-request Hyperdrive→Postgres socket, +// the Cloudflare dynamic-worker code substrate, MCP served by a Durable-Object +// session store (the DO surfaced via `config.mcpExport`), console+Sentry error +// capture — and Autumn BILLING entering ONLY as extensions: the engine +// metering decorator, the account seat-gate, the `/api/autumn/*` proxy route, +// and the createOrganization free-limit gate. `diff` against +// `apps/host-selfhost/src/app.ts` is the entire product difference. +// +// `ExecutorApp.make` owns the assembly (the execution-stack middleware wrapping +// the protected API, the MCP envelope, the account API on the /api-prefixed +// router, the extension routes, provideMerge(boot)). This file slots cloud's +// Pass-6 provider Layers into the named seams. +// +// Request scoping (Cloudflare Workers' I/O isolation): the postgres.js socket +// MUST be rebuilt per request. `requestScoped` is folded by `make` into the +// execution-stack middleware; the account + session extension routes fold their +// own `requestScopedMiddleware`. `boot` holds only long-lived context (WorkOS +// client, telemetry, billing service shell, the resolved identity provider). +// =========================================================================== + +// The WorkOS control plane: the raw SDK client (`CoreSharedServices`) is the +// base; the api-key service builds on it, so each WorkOS-dependent service shares +// the one boot `WorkOSClient`. Surfaces both tags (the api-key service is read by +// the account provider + MCP seam, AND by the per-request identity layer below). +// Lives in `boot`, so `workosIdentityLayer`'s residual `WorkOSClient | +// ApiKeyService` (the long-lived control plane it reads) resolves from there. +const apiKeyService = ApiKeyService.WorkOS.pipe(Layer.provide(CoreSharedServices)); +const controlPlane = Layer.mergeAll(CoreSharedServices, apiKeyService); + +// `CloudDbProvider` only reads the per-request `DbService` at runtime; we widen +// its residual type to also carry the boot `AutumnService` the metering +// decorator reads, so `make` infers `RDb = DbService | AutumnService` (both +// satisfied by `boot`, `DbService` per request via `requestScoped`). +const cloudDb: Layer.Layer = CloudDbProvider; + +const { appLayer, toWebHandler, mcpExport } = ExecutorApp.make({ + plugins: cloudPlugins, + providers: { + // Identity: the NEUTRAL `IdentityProvider`. WorkOS api-key Bearer BEATS + // sealed-session cookie (precedence inside `workosIdentityLayer`). Maps + // rejected credentials to the shared `Unauthorized | NoOrganization | + // Unavailable`; cloud's failure strategy renders the exact `{ error, code }` + // JSON bytes at 401/403/503. The facade builds `authenticate` from the + // `IdentityProvider` tag and provides THIS layer per request over + // `requestScoped`, so the identity resolution lives in the request fiber's + // socket scope. Its residual `UserStoreService` resolves from `requestScoped` + // (the per-request socket); `WorkOSClient | ApiKeyService` from `boot`. + identity: workosIdentityLayer, + // The WorkOS account API (me / api-keys / org), built per request so the + // service closes over the per-request postgres socket; carries the Autumn + // seat-gate. Self-combines `requestScopedMiddleware`. + account: workosAccountMiddleware(RequestScopedServicesLive), + db: cloudDb, + engine: { + codeExecutor: CloudCodeExecutorProvider, + // Billing-as-extension #1: the usage-metering decorator (reads AutumnService). + decorator: CloudMeteringEngineDecorator, + }, + mcp: { + auth: cloudMcpAuth, + sessions: cloudMcpSessions, + reporter: cloudMcpReporter, + }, + plugins: { provider: CloudPluginsProvider, config: CloudHostConfig }, + errorCapture: ErrorCaptureLive, + }, + extensions: { + // Cloud's app-only HTTP surface: WorkOS session routes, domain-verification, + // Swagger/OpenAPI, the Autumn billing proxy, request-failure logging. + routes: makeCloudExtensionRoutes(RequestScopedServicesLive), + }, + config: { + mountPrefix: "/api", + // Cloud renders the shared identity errors as its exact `{ error, code }` + // JSON at 401/403/503 (byte-identical to the old `HttpResponseError` bodies). + failure: cloudIdentityFailureStrategy, + // The MCP session Durable Object class — a top-level Workers export a Layer + // can't return; surfaced so `server.ts` can re-export it. + mcpExport: McpSessionDO, + }, + // The long-lived (boot-scoped) context provideMerge'd under everything: the + // WorkOS control plane (the raw `WorkOSClient` + `ApiKeyService` the per-request + // identity layer reads residually), billing's service shell (read by the + // metered decorator + free-limit gate), the worker tracer, and the HTTP + // platform. A boot-time WorkOS misconfig is unrecoverable -> `orDie`. + boot: controlPlane.pipe( + Layer.merge( + Layer.mergeAll(WorkerTelemetryLive, HttpServer.layerServices, AutumnService.Default), + ), + // oxlint-disable-next-line executor/no-effect-escape-hatch -- boundary: a boot-time WorkOS misconfiguration is unrecoverable + Layer.orDie, + ), + // Per request: the postgres socket (`DbService` / `UserStoreService`). The facade + // provide-merges `providers.identity` over THIS layer, so the neutral + // `IdentityProvider` is rebuilt per request in the same fiber scope as the socket + // it reads (Cloudflare Workers' I/O isolation) — the identity layer's per-request + // `UserStoreService` is covered by this layer (its `WorkOSClient | ApiKeyService` + // by `boot`). + requestScoped: RequestScopedServicesLive, +}); + +export { McpSessionDO }; + +export const CloudAppLayer = appLayer; +export const cloudMcpExport = mcpExport; + +// The unified cloud web handler: serves /api/*, /api/auth/*, /mcp, +// /.well-known/*, /api/docs — everything the worker dispatches. +export const cloudApiHandler = toWebHandler; diff --git a/apps/cloud/src/auth/api-key-errors.ts b/apps/cloud/src/auth/api-key-errors.ts deleted file mode 100644 index 6a90e5318..000000000 --- a/apps/cloud/src/auth/api-key-errors.ts +++ /dev/null @@ -1,7 +0,0 @@ -import { Schema } from "effect"; - -export class ApiKeyManagementError extends Schema.TaggedErrorClass()( - "ApiKeyManagementError", - { cause: Schema.Unknown }, - { httpApiStatus: 500 }, -) {} diff --git a/apps/cloud/src/auth/api-keys.node.test.ts b/apps/cloud/src/auth/api-keys.node.test.ts index 319948871..6208dae37 100644 --- a/apps/cloud/src/auth/api-keys.node.test.ts +++ b/apps/cloud/src/auth/api-keys.node.test.ts @@ -2,15 +2,15 @@ import { describe, expect, it } from "@effect/vitest"; import { Effect, Layer } from "effect"; import { ApiKeyService } from "./api-keys"; -import { WorkOSAuth, type WorkOSAuthService } from "./workos"; +import { WorkOSClient, type WorkOSClientService } from "./workos"; -const stubWorkOS = (overrides: Partial) => +const stubWorkOS = (overrides: Partial) => Layer.succeed( - WorkOSAuth, - new Proxy({} as WorkOSAuthService, { + WorkOSClient, + new Proxy({} as WorkOSClientService, { get: (_target, prop) => { - if (prop in overrides) return overrides[prop as keyof WorkOSAuthService]; - return () => Effect.die(`unexpected WorkOSAuth.${String(prop)} call`); + if (prop in overrides) return overrides[prop as keyof WorkOSClientService]; + return () => Effect.die(`unexpected WorkOSClient.${String(prop)} call`); }, }), ); diff --git a/apps/cloud/src/auth/api-keys.test-layer.ts b/apps/cloud/src/auth/api-keys.test-layer.ts index e190ce520..26d738308 100644 --- a/apps/cloud/src/auth/api-keys.test-layer.ts +++ b/apps/cloud/src/auth/api-keys.test-layer.ts @@ -1,7 +1,7 @@ import { Effect, Layer } from "effect"; import { ApiKeyService } from "./api-keys"; -import { ApiKeyManagementError } from "./api-key-errors"; +import { ApiKeyManagementError } from "./errors"; export const ApiKeyServiceTestLayer = Layer.succeed(ApiKeyService)({ validate: () => Effect.succeed(null), diff --git a/apps/cloud/src/auth/api-keys.ts b/apps/cloud/src/auth/api-keys.ts index f60928553..2984f5987 100644 --- a/apps/cloud/src/auth/api-keys.ts +++ b/apps/cloud/src/auth/api-keys.ts @@ -1,9 +1,11 @@ import { Context, Data, Effect, Layer, Option, Schema } from "effect"; -import { ApiKeyManagementError } from "./api-key-errors"; -import { WorkOSAuth } from "./workos"; +import { ApiKeyManagementError } from "./errors"; +import { WorkOSClient } from "./workos"; -export type ApiKeyPrincipal = { +/** The owner an api key resolves to — NOT a full {@link Principal} (no email / + * name / roles), so it carries an honest, distinct name. */ +export type ApiKeyOwner = { readonly accountId: string; readonly organizationId: string; readonly keyId: string; @@ -80,7 +82,7 @@ const decodeValidateApiKeyResponse = Schema.decodeUnknownOption(ValidateApiKeyRe const decodeListApiKeysResponse = Schema.decodeUnknownOption(ListApiKeysResponse); const decodeCreateApiKeyResponse = Schema.decodeUnknownOption(CreateApiKeyResponse); -const principalFromResponse = (value: unknown): ApiKeyPrincipal | null => +const ownerFromResponse = (value: unknown): ApiKeyOwner | null => Option.match(decodeValidateApiKeyResponse(value), { onNone: () => null, onSome: ({ apiKey }) => { @@ -132,9 +134,7 @@ const createdFromResponse = (value: unknown): CreatedApiKey | null => export class ApiKeyService extends Context.Service< ApiKeyService, { - readonly validate: ( - value: string, - ) => Effect.Effect; + readonly validate: (value: string) => Effect.Effect; readonly listUserKeys: (input: { readonly accountId: string; readonly organizationId: string; @@ -151,11 +151,11 @@ export class ApiKeyService extends Context.Service< >()("@executor-js/cloud/ApiKeyService") { static WorkOS = Layer.effect(this)( Effect.gen(function* () { - const workos = yield* WorkOSAuth; + const workos = yield* WorkOSClient; return { validate: (value: string) => workos.validateApiKey(value).pipe( - Effect.map(principalFromResponse), + Effect.map(ownerFromResponse), Effect.mapError((cause) => new ApiKeyValidationError({ cause })), ), listUserKeys: ({ accountId, organizationId }) => diff --git a/apps/cloud/src/auth/api.ts b/apps/cloud/src/auth/api.ts index 912488ed5..973ade561 100644 --- a/apps/cloud/src/auth/api.ts +++ b/apps/cloud/src/auth/api.ts @@ -1,8 +1,8 @@ import { HttpApiEndpoint, HttpApiGroup } from "effect/unstable/httpapi"; import { Schema } from "effect"; -import { ApiKeyManagementError } from "./api-key-errors"; import { UserStoreError, WorkOSError } from "./errors"; -import { NoOrganization, SessionAuth } from "./middleware"; +import { NoOrganization } from "@executor-js/api/server"; +import { SessionAuth } from "./middleware"; const AuthUser = Schema.Struct({ id: Schema.String, @@ -78,35 +78,6 @@ const AcceptInvitationResponse = Schema.Struct({ name: Schema.String, }); -const ApiKeySummary = Schema.Struct({ - id: Schema.String, - name: Schema.String, - obfuscatedValue: Schema.String, - createdAt: Schema.String, - updatedAt: Schema.String, - lastUsedAt: Schema.NullOr(Schema.String), -}); - -const ApiKeysResponse = Schema.Struct({ - apiKeys: Schema.Array(ApiKeySummary), -}); - -const CreateApiKeyBody = Schema.Struct({ - name: Schema.String, -}); - -const CreatedApiKeyResponse = Schema.Struct({ - id: Schema.String, - name: Schema.String, - obfuscatedValue: Schema.String, - createdAt: Schema.String, - updatedAt: Schema.String, - lastUsedAt: Schema.NullOr(Schema.String), - value: Schema.String, -}); - -const ApiKeyParams = { apiKeyId: Schema.String }; - const McpSessionExecutionParams = { mcpSessionId: Schema.String, executionId: Schema.String, @@ -164,7 +135,6 @@ export const AUTH_PATHS = { } as const; const AuthErrors = [UserStoreError, WorkOSError] as const; -const ApiKeyErrors = [ApiKeyManagementError, NoOrganization, UserStoreError, WorkOSError] as const; const McpApprovalErrors = [ NoOrganization, McpExecutionNotFoundError, @@ -222,25 +192,6 @@ export class CloudAuthApi extends HttpApiGroup.make("cloudAuth") error: AuthErrors, }), ) - .add( - HttpApiEndpoint.get("listApiKeys", "/auth/api-keys", { - success: ApiKeysResponse, - error: ApiKeyErrors, - }), - ) - .add( - HttpApiEndpoint.post("createApiKey", "/auth/api-keys", { - payload: CreateApiKeyBody, - success: CreatedApiKeyResponse, - error: ApiKeyErrors, - }), - ) - .add( - HttpApiEndpoint.delete("revokeApiKey", "/auth/api-keys/:apiKeyId", { - params: ApiKeyParams, - error: ApiKeyErrors, - }), - ) .add( HttpApiEndpoint.get("getMcpPaused", "/mcp-sessions/:mcpSessionId/executions/:executionId", { params: McpSessionExecutionParams, diff --git a/apps/cloud/src/auth/authorize-organization.ts b/apps/cloud/src/auth/authorize-organization.ts deleted file mode 100644 index a73fd4dfa..000000000 --- a/apps/cloud/src/auth/authorize-organization.ts +++ /dev/null @@ -1,37 +0,0 @@ -// --------------------------------------------------------------------------- -// Organization authorization — live membership check against WorkOS. -// --------------------------------------------------------------------------- -// -// The sealed session cookie carries an organizationId that WorkOS signed at -// login / refresh time. WorkOS does NOT invalidate existing sessions when a -// membership is revoked, and `session.authenticate()` validates the JWT -// locally without hitting the API — so a removed user keeps full access -// until their access token naturally expires (~10 min). -// -// To close that gap we verify membership live on every protected request. -// `listUserMemberships` is one WorkOS call per request. If this becomes a -// hot path we can layer a short per-(user, org) TTL cache underneath, or -// swap it for a local memberships table fed by the WorkOS Events API. -// -// Returns the resolved organization (via resolveOrganization) if the user -// currently holds an *active* membership in it, otherwise null. Callers -// should treat null as "no access" and route accordingly (onboarding page / -// 403). - -import { Effect } from "effect"; - -import { resolveOrganization } from "./resolve-organization"; -import { WorkOSAuth } from "./workos"; - -export const authorizeOrganization = (userId: string, organizationId: string) => - Effect.gen(function* () { - const workos = yield* WorkOSAuth; - const memberships = yield* workos.listUserMemberships(userId); - const active = memberships.data.find( - (m: { readonly organizationId: string; readonly status: string }) => - m.organizationId === organizationId && m.status === "active", - ); - if (!active) return null; - - return yield* resolveOrganization(organizationId); - }); diff --git a/apps/cloud/src/auth/bearer.ts b/apps/cloud/src/auth/bearer.ts new file mode 100644 index 000000000..ab0a8cfaf --- /dev/null +++ b/apps/cloud/src/auth/bearer.ts @@ -0,0 +1,9 @@ +// --------------------------------------------------------------------------- +// Bearer token parsing — single-sourced HTTP `Authorization: Bearer …` prefix. +// +// Shared by every cloud credential path that splits a bearer token off the +// `Authorization` header (the WorkOS api-key/session resolver and the MCP edge +// auth). Defined once so the literal cannot drift. +// --------------------------------------------------------------------------- + +export const BEARER_PREFIX = "Bearer "; diff --git a/apps/cloud/src/auth/context.ts b/apps/cloud/src/auth/context.ts index 0734e46f6..933a9ea65 100644 --- a/apps/cloud/src/auth/context.ts +++ b/apps/cloud/src/auth/context.ts @@ -3,9 +3,6 @@ import { makeUserStore } from "../services/user-store"; import { DbService } from "../services/db"; import { UserStoreError, tryPromiseService, withServiceLogging } from "./errors"; -// AuthContext is defined in ./middleware.ts to keep middleware-related types together. -export { AuthContext } from "./middleware"; - // --------------------------------------------------------------------------- // UserStoreService — wraps the Drizzle-backed user store with Effect // --------------------------------------------------------------------------- diff --git a/apps/cloud/src/auth/errors.ts b/apps/cloud/src/auth/errors.ts index 36e48c0b4..775916ce1 100644 --- a/apps/cloud/src/auth/errors.ts +++ b/apps/cloud/src/auth/errors.ts @@ -12,6 +12,12 @@ export class WorkOSError extends Schema.TaggedErrorClass()( { httpApiStatus: 500 }, ) {} +export class ApiKeyManagementError extends Schema.TaggedErrorClass()( + "ApiKeyManagementError", + { cause: Schema.Unknown }, + { httpApiStatus: 500 }, +) {} + /** * Private wrapper used by service adapters that lift Promise APIs into * Effect. `withServiceLogging` immediately remaps these into a public-facing diff --git a/apps/cloud/src/auth/handlers.node.test.ts b/apps/cloud/src/auth/handlers.node.test.ts index 108c2385f..8ba2c69ea 100644 --- a/apps/cloud/src/auth/handlers.node.test.ts +++ b/apps/cloud/src/auth/handlers.node.test.ts @@ -8,12 +8,12 @@ import { CloudAuthPublicApi } from "./api"; import { CloudAuthPublicHandlers } from "./handlers"; import { UserStoreService } from "./context"; import { WorkOSError } from "./errors"; -import { WorkOSAuth } from "./workos"; +import { WorkOSClient } from "./workos"; const TestAuthPublicApi = HttpApi.make("cloudWeb").add(CloudAuthPublicApi); type EffectSuccess = T extends EffectType ? A : never; type AuthenticateWithCodeResult = EffectSuccess< - ReturnType + ReturnType >; const fakeUser: AuthenticateWithCodeResult["user"] = { object: "user", @@ -35,10 +35,10 @@ class UnstubbedWorkOSMethod extends Data.TaggedError("UnstubbedWorkOSMethod")<{ method: string; }> {} -const makeAuthFetch = (workos: Partial) => { +const makeAuthFetch = (workos: Partial) => { const WorkOSTest = Layer.succeed( - WorkOSAuth, - new Proxy(workos as WorkOSAuth["Service"], { + WorkOSClient, + new Proxy(workos as WorkOSClient["Service"], { get: (target, prop) => { if (prop in target) return target[prop as keyof typeof target]; return () => @@ -202,7 +202,7 @@ describe("Auth callback handlers", () => { status: "pending", }, ], - })) as unknown as WorkOSAuth["Service"]["listUserMemberships"], + })) as unknown as WorkOSClient["Service"]["listUserMemberships"], refreshSession: () => Effect.sync(() => { refreshCalls++; @@ -250,9 +250,9 @@ describe("Auth callback handlers", () => { status: "active", }, ], - })) as unknown as WorkOSAuth["Service"]["listUserMemberships"], + })) as unknown as WorkOSClient["Service"]["listUserMemberships"], refreshSession: (() => - Effect.fail(new WorkOSError())) as WorkOSAuth["Service"]["refreshSession"], + Effect.fail(new WorkOSError())) as WorkOSClient["Service"]["refreshSession"], }); const response = yield* Effect.promise(() => diff --git a/apps/cloud/src/auth/handlers.ts b/apps/cloud/src/auth/handlers.ts index a48914559..c4d395072 100644 --- a/apps/cloud/src/auth/handlers.ts +++ b/apps/cloud/src/auth/handlers.ts @@ -10,21 +10,23 @@ import { McpExecutionNotFoundError, McpSessionForbiddenError, } from "./api"; -import { NoOrganization, SessionContext } from "./middleware"; +import { NoOrganization } from "@executor-js/api/server"; +import { SessionContext } from "./middleware"; import { UserStoreService } from "./context"; -import { authorizeOrganization } from "./authorize-organization"; import { env } from "cloudflare:workers"; -import { ApiKeyManagementError } from "./api-key-errors"; import { WorkOSError } from "./errors"; -import { WorkOSAuth } from "./workos"; -import { ApiKeyService } from "./api-keys"; +import { WorkOSClient } from "./workos"; import { AutumnService } from "../services/autumn"; import { hasPaidOrganizationSubscription, isOverFreeOrganizationLimit, shouldApplyFreeOrganizationLimit, -} from "./organization-limits"; -import type { McpSessionApprovalResult, McpSessionResumeApprovalResult } from "../mcp-session"; +} from "../services/autumn-plans"; +import { authorizeOrganization } from "./organization"; +import type { + McpSessionApprovalResult, + McpSessionResumeApprovalResult, +} from "../mcp/session-durable-object"; const COOKIE_OPTIONS = { path: "/", @@ -62,8 +64,6 @@ const DELETE_COOKIE_OPTIONS = { secure: true, }; -const MAX_API_KEY_NAME_LENGTH = 80; - const randomState = (): string => { const bytes = new Uint8Array(32); crypto.getRandomValues(bytes); @@ -79,16 +79,6 @@ const timingSafeEqual = (a: string, b: string): boolean => { return diff === 0; }; -const requireSessionOrganization = Effect.gen(function* () { - const session = yield* SessionContext; - if (!session.organizationId) { - return yield* new NoOrganization(); - } - const org = yield* authorizeOrganization(session.accountId, session.organizationId); - if (!org) return yield* new NoOrganization(); - return { session, org }; -}); - const requireSessionOrganizationId = Effect.gen(function* () { const session = yield* SessionContext; if (!session.organizationId) { @@ -156,7 +146,7 @@ export const CloudAuthPublicHandlers = HttpApiBuilder.group( handlers .handleRaw("login", () => Effect.gen(function* () { - const workos = yield* WorkOSAuth; + const workos = yield* WorkOSClient; // Use the explicit public site URL — in dev, the request's Host // header points at the internal proxy target, not the public URL // WorkOS needs to redirect back to. @@ -173,7 +163,7 @@ export const CloudAuthPublicHandlers = HttpApiBuilder.group( ) .handleRaw("callback", ({ request, query }) => Effect.gen(function* () { - const workos = yield* WorkOSAuth; + const workos = yield* WorkOSClient; const users = yield* UserStoreService; const cookieState = request.cookies[STATE_COOKIE] ?? null; // CSRF check is only enforced when the redirect carries a state @@ -268,7 +258,7 @@ export const CloudSessionAuthHandlers = HttpApiBuilder.group( }) .handle("organizations", () => Effect.gen(function* () { - const workos = yield* WorkOSAuth; + const workos = yield* WorkOSClient; const session = yield* SessionContext; const memberships = yield* workos.listUserMemberships(session.accountId); @@ -290,7 +280,7 @@ export const CloudSessionAuthHandlers = HttpApiBuilder.group( ) .handle("switchOrganization", ({ payload }) => Effect.gen(function* () { - const workos = yield* WorkOSAuth; + const workos = yield* WorkOSClient; const session = yield* SessionContext; const refreshed = yield* workos.refreshSession( @@ -304,7 +294,7 @@ export const CloudSessionAuthHandlers = HttpApiBuilder.group( ) .handle("createOrganization", ({ payload }) => Effect.gen(function* () { - const workos = yield* WorkOSAuth; + const workos = yield* WorkOSClient; const users = yield* UserStoreService; const session = yield* SessionContext; const autumn = yield* AutumnService; @@ -375,7 +365,7 @@ export const CloudSessionAuthHandlers = HttpApiBuilder.group( ) .handle("pendingInvitations", () => Effect.gen(function* () { - const workos = yield* WorkOSAuth; + const workos = yield* WorkOSClient; const session = yield* SessionContext; const invitations = yield* workos.listInvitationsByEmail(session.email); @@ -424,7 +414,7 @@ export const CloudSessionAuthHandlers = HttpApiBuilder.group( ) .handle("acceptInvitation", ({ payload }) => Effect.gen(function* () { - const workos = yield* WorkOSAuth; + const workos = yield* WorkOSClient; const users = yield* UserStoreService; const session = yield* SessionContext; @@ -454,7 +444,7 @@ export const CloudSessionAuthHandlers = HttpApiBuilder.group( if (!refreshed || !verified || verified.organizationId !== org.id) { yield* Effect.logWarning("acceptInvitation: unable to attach org to current session", { userId: session.accountId, - orgId: org.id, + organizationId: org.id, refreshReturnedSession: refreshed != null, verifiedOrgId: verified?.organizationId ?? null, }); @@ -466,33 +456,6 @@ export const CloudSessionAuthHandlers = HttpApiBuilder.group( return { id: org.id, name: org.name }; }), ) - .handle("listApiKeys", () => - Effect.gen(function* () { - const { session, org } = yield* requireSessionOrganization; - const apiKeys = yield* ApiKeyService; - const keys = yield* apiKeys.listUserKeys({ - accountId: session.accountId, - organizationId: org.id, - }); - return { apiKeys: keys }; - }), - ) - .handle("createApiKey", ({ payload }) => - Effect.gen(function* () { - const { session, org } = yield* requireSessionOrganization; - const name = payload.name.trim().slice(0, MAX_API_KEY_NAME_LENGTH); - if (!name) { - return yield* new ApiKeyManagementError({ cause: "missing_name" }); - } - - const apiKeys = yield* ApiKeyService; - return yield* apiKeys.createUserKey({ - accountId: session.accountId, - organizationId: org.id, - name, - }); - }), - ) .handle("getMcpPaused", ({ params }) => Effect.gen(function* () { const owner = yield* requireSessionOrganizationId; @@ -553,19 +516,5 @@ export const CloudSessionAuthHandlers = HttpApiBuilder.group( isError: result.isError ?? false, }; }), - ) - .handle("revokeApiKey", ({ params }) => - Effect.gen(function* () { - const { session, org } = yield* requireSessionOrganization; - const apiKeys = yield* ApiKeyService; - const ownedKeys = yield* apiKeys.listUserKeys({ - accountId: session.accountId, - organizationId: org.id, - }); - if (!ownedKeys.some((key) => key.id === params.apiKeyId)) { - return yield* new ApiKeyManagementError({ cause: "api_key_not_found" }); - } - yield* apiKeys.revokeUserKey({ keyId: params.apiKeyId }); - }), ), ); diff --git a/apps/cloud/src/auth/middleware-live.ts b/apps/cloud/src/auth/middleware-live.ts index 62490b337..c1549f4a1 100644 --- a/apps/cloud/src/auth/middleware-live.ts +++ b/apps/cloud/src/auth/middleware-live.ts @@ -5,20 +5,15 @@ import { Effect, Layer, Redacted } from "effect"; -import { - AuthContext, - NoOrganization, - OrgAuth, - SessionAuth, - SessionContext, - Unauthorized, -} from "./middleware"; -import { WorkOSAuth } from "./workos"; +import { AuthContext, NoOrganization, Unauthorized } from "@executor-js/api/server"; + +import { OrgAuth, SessionAuth, SessionContext, sessionFromSealed } from "./middleware"; +import { WorkOSClient } from "./workos"; export const SessionAuthLive = Layer.effect( SessionAuth, Effect.gen(function* () { - const workos = yield* WorkOSAuth; + const workos = yield* WorkOSClient; return { cookie: (httpEffect, { credential }) => Effect.gen(function* () { @@ -30,16 +25,7 @@ export const SessionAuthLive = Layer.effect( return yield* Effect.fail(new Unauthorized()); } - const session = { - accountId: result.userId, - email: result.email, - name: `${result.firstName ?? ""} ${result.lastName ?? ""}`.trim() || null, - avatarUrl: result.avatarUrl ?? null, - organizationId: result.organizationId ?? null, - sealedSession: result.refreshedSession ?? Redacted.value(credential), - refreshedSession: result.refreshedSession ?? null, - }; - + const session = sessionFromSealed(result, Redacted.value(credential)); return yield* Effect.provideService(httpEffect, SessionContext, session); }), }; @@ -49,7 +35,7 @@ export const SessionAuthLive = Layer.effect( export const OrgAuthLive = Layer.effect( OrgAuth, Effect.gen(function* () { - const workos = yield* WorkOSAuth; + const workos = yield* WorkOSClient; return { cookie: (httpEffect, { credential }) => Effect.gen(function* () { @@ -65,12 +51,17 @@ export const OrgAuthLive = Layer.effect( return yield* Effect.fail(new NoOrganization()); } + const session = sessionFromSealed(result, Redacted.value(credential)); const auth = { - accountId: result.userId, + accountId: session.accountId, organizationId: result.organizationId, - email: result.email, - name: `${result.firstName ?? ""} ${result.lastName ?? ""}`.trim() || null, - avatarUrl: result.avatarUrl ?? null, + email: session.email, + name: session.name, + avatarUrl: session.avatarUrl, + // The unified `AuthContext` carries roles; cloud's WorkOS control + // plane does not resolve them here, so pass an empty list (no cloud + // handler reads roles today). + roles: [], }; return yield* Effect.provideService(httpEffect, AuthContext, auth); diff --git a/apps/cloud/src/auth/middleware.ts b/apps/cloud/src/auth/middleware.ts index 8a6409d56..089895395 100644 --- a/apps/cloud/src/auth/middleware.ts +++ b/apps/cloud/src/auth/middleware.ts @@ -5,9 +5,16 @@ // the SPA pulls in for typed schemas). // --------------------------------------------------------------------------- -import { Context, Schema } from "effect"; +import { Context } from "effect"; import { HttpApiMiddleware, HttpApiSecurity } from "effect/unstable/httpapi"; +// The executor-API identity seam lives in `@executor-js/api/server`: the one +// `AuthContext` handlers read (carries roles) and the one `Unauthorized` / +// `NoOrganization` error pair (httpApiStatus 401 / 403), shared with self-host. +// These are the canonical tags; consumers import them from `@executor-js/api/server` +// directly. This module reads them to declare `SessionAuth` / `OrgAuth`. +import { AuthContext, NoOrganization, Unauthorized } from "@executor-js/api/server"; + // --------------------------------------------------------------------------- // Session — what every authenticated request gets // --------------------------------------------------------------------------- @@ -27,21 +34,45 @@ export class SessionContext extends Context.Service()( "@executor-js/cloud/Session", ) {} -// --------------------------------------------------------------------------- -// Errors -// --------------------------------------------------------------------------- +/** + * The authenticated result shape `WorkOSClient.authenticateSealedSession` / + * `authenticateRequest` yield. Structural so the mapper below stays a pure + * function with no WorkOS-SDK import (this module is in the SPA bundle). + */ +export type SealedSessionResult = { + readonly userId: string; + readonly email: string; + readonly firstName?: string | null; + readonly lastName?: string | null; + readonly avatarUrl?: string | null; + readonly organizationId?: string | null; + readonly refreshedSession?: string | undefined; +}; -export class Unauthorized extends Schema.TaggedErrorClass()( - "Unauthorized", - {}, - { httpApiStatus: 401 }, -) {} +/** The display name WorkOS first/last fields collapse to, or `null`. */ +export const sealedSessionDisplayName = (result: SealedSessionResult): string | null => + `${result.firstName ?? ""} ${result.lastName ?? ""}`.trim() || null; -export class NoOrganization extends Schema.TaggedErrorClass()( - "NoOrganization", - {}, - { httpApiStatus: 403 }, -) {} +/** + * The ONE sealed-session → {@link Session} mapper. `SessionAuthLive` and the + * account-API session middleware both build a `Session` from a verified + * sealed-session result; this folds their (previously inline, byte-identical) + * copies into one. `sealedSessionFallback` is the cookie value to keep as the + * `sealedSession` when WorkOS didn't hand back a refreshed one (the cookie for + * `SessionAuthLive`, `""` for the account API which never re-sets the cookie). + */ +export const sessionFromSealed = ( + result: SealedSessionResult, + sealedSessionFallback: string, +): Session => ({ + accountId: result.userId, + email: result.email, + name: sealedSessionDisplayName(result), + avatarUrl: result.avatarUrl ?? null, + organizationId: result.organizationId ?? null, + sealedSession: result.refreshedSession ?? sealedSessionFallback, + refreshedSession: result.refreshedSession ?? null, +}); // --------------------------------------------------------------------------- // SessionAuth — resolves the WorkOS session cookie, provides SessionContext @@ -58,20 +89,10 @@ export class SessionAuth extends HttpApiMiddleware.Service< }) {} // --------------------------------------------------------------------------- -// OrgAuth — like SessionAuth but rejects sessions with no organization +// OrgAuth — like SessionAuth but rejects sessions with no organization. +// Provides the shared `AuthContext` (re-exported above). // --------------------------------------------------------------------------- -export class AuthContext extends Context.Service< - AuthContext, - { - readonly accountId: string; - readonly organizationId: string; - readonly email: string; - readonly name: string | null; - readonly avatarUrl: string | null; - } ->()("@executor-js/cloud/AuthContext") {} - export class OrgAuth extends HttpApiMiddleware.Service()( "OrgAuth", { diff --git a/apps/cloud/src/auth/organization-limits.ts b/apps/cloud/src/auth/organization-limits.ts deleted file mode 100644 index e67164273..000000000 --- a/apps/cloud/src/auth/organization-limits.ts +++ /dev/null @@ -1,37 +0,0 @@ -import { - ACTIVE_AUTUMN_SUBSCRIPTION_STATUSES, - PAID_AUTUMN_PLAN_IDS, -} from "../services/autumn-plans"; - -export const FREE_ORGANIZATIONS_PER_USER_LIMIT = 3; - -export type OrganizationLimitSubscriptionSummary = { - readonly planId?: string | null; - readonly status?: string | null; -}; - -export type OrganizationLimitMembershipSummary = { - readonly organizationId: string; - readonly status?: string | null; -}; - -export const isPaidOrganizationSubscription = ( - subscription: OrganizationLimitSubscriptionSummary, -): boolean => - subscription.planId != null && - PAID_AUTUMN_PLAN_IDS.has(subscription.planId) && - ACTIVE_AUTUMN_SUBSCRIPTION_STATUSES.has(subscription.status ?? ""); - -export const hasPaidOrganizationSubscription = ( - subscriptions: ReadonlyArray, -): boolean => subscriptions.some(isPaidOrganizationSubscription); - -export const shouldApplyFreeOrganizationLimit = ( - activeMemberships: ReadonlyArray, - paidOrganizationIds: ReadonlySet, -): boolean => - !activeMemberships.some((membership) => paidOrganizationIds.has(membership.organizationId)); - -export const isOverFreeOrganizationLimit = ( - activeMemberships: ReadonlyArray, -): boolean => activeMemberships.length >= FREE_ORGANIZATIONS_PER_USER_LIMIT; diff --git a/apps/cloud/src/auth/organization.ts b/apps/cloud/src/auth/organization.ts new file mode 100644 index 000000000..7a1992f6d --- /dev/null +++ b/apps/cloud/src/auth/organization.ts @@ -0,0 +1,74 @@ +// --------------------------------------------------------------------------- +// Organization resolution + authorization. +// +// One module for the cloud org auth-resolution path: +// - `resolveOrganization` — local mirror with lazy WorkOS fallback. +// - `authorizeOrganization` — live membership check, returns the resolved org. +// +// Deliberately billing-FREE: this module is reached by the MCP session DO bundle +// (via `mcp/auth.ts`), which must not transitively import any billing config +// (`autumn.config` / `atmn`). The free-organizations-per-user limit predicates — +// which DO depend on the Autumn plan config — live in `services/autumn-plans.ts`. +// --------------------------------------------------------------------------- + +import { Effect } from "effect"; + +import { UserStoreService } from "./context"; +import { WorkOSClient } from "./workos"; + +// --------------------------------------------------------------------------- +// Resolution — local mirror with lazy WorkOS fallback. +// --------------------------------------------------------------------------- +// +// We keep a minimal local mirror of organizations so domain tables can +// foreign-key against them and so we don't hit WorkOS on every request. +// But the mirror can drift: a user's session can reference an org that was +// created outside this app (or before the mirror existed). Rather than +// proactively mirroring on every login — which was the source of the messy +// callback flow we just untangled — we mirror lazily the first time an +// unknown org is read. All other callers just do `getOrganization` and get +// a self-healing lookup for free. + +export const resolveOrganization = (organizationId: string) => + Effect.gen(function* () { + const users = yield* UserStoreService; + const existing = yield* users.use((s) => s.getOrganization(organizationId)); + if (existing) return existing; + + const workos = yield* WorkOSClient; + const fresh = yield* workos.getOrganization(organizationId); + return yield* users.use((s) => s.upsertOrganization({ id: fresh.id, name: fresh.name })); + }); + +// --------------------------------------------------------------------------- +// Authorization — live membership check against WorkOS. +// --------------------------------------------------------------------------- +// +// The sealed session cookie carries an organizationId that WorkOS signed at +// login / refresh time. WorkOS does NOT invalidate existing sessions when a +// membership is revoked, and `session.authenticate()` validates the JWT +// locally without hitting the API — so a removed user keeps full access +// until their access token naturally expires (~10 min). +// +// To close that gap we verify membership live on every protected request. +// `listUserMemberships` is one WorkOS call per request. If this becomes a +// hot path we can layer a short per-(user, org) TTL cache underneath, or +// swap it for a local memberships table fed by the WorkOS Events API. +// +// Returns the resolved organization (via resolveOrganization) if the user +// currently holds an *active* membership in it, otherwise null. Callers +// should treat null as "no access" and route accordingly (onboarding page / +// 403). + +export const authorizeOrganization = (userId: string, organizationId: string) => + Effect.gen(function* () { + const workos = yield* WorkOSClient; + const memberships = yield* workos.listUserMemberships(userId); + const active = memberships.data.find( + (m: { readonly organizationId: string; readonly status: string }) => + m.organizationId === organizationId && m.status === "active", + ); + if (!active) return null; + + return yield* resolveOrganization(organizationId); + }); diff --git a/apps/cloud/src/auth/resolve-organization.ts b/apps/cloud/src/auth/resolve-organization.ts deleted file mode 100644 index b0cd5fdc1..000000000 --- a/apps/cloud/src/auth/resolve-organization.ts +++ /dev/null @@ -1,28 +0,0 @@ -// --------------------------------------------------------------------------- -// Organization lookup — local mirror with lazy WorkOS fallback. -// --------------------------------------------------------------------------- -// -// We keep a minimal local mirror of organizations so domain tables can -// foreign-key against them and so we don't hit WorkOS on every request. -// But the mirror can drift: a user's session can reference an org that was -// created outside this app (or before the mirror existed). Rather than -// proactively mirroring on every login — which was the source of the messy -// callback flow we just untangled — we mirror lazily the first time an -// unknown org is read. All other callers just do `getOrganization` and get -// a self-healing lookup for free. - -import { Effect } from "effect"; - -import { UserStoreService } from "./context"; -import { WorkOSAuth } from "./workos"; - -export const resolveOrganization = (organizationId: string) => - Effect.gen(function* () { - const users = yield* UserStoreService; - const existing = yield* users.use((s) => s.getOrganization(organizationId)); - if (existing) return existing; - - const workos = yield* WorkOSAuth; - const fresh = yield* workos.getOrganization(organizationId); - return yield* users.use((s) => s.upsertOrganization({ id: fresh.id, name: fresh.name })); - }); diff --git a/apps/cloud/src/auth/workos-auth-provider.ts b/apps/cloud/src/auth/workos-auth-provider.ts new file mode 100644 index 000000000..4bd5495f3 --- /dev/null +++ b/apps/cloud/src/auth/workos-auth-provider.ts @@ -0,0 +1,224 @@ +// --------------------------------------------------------------------------- +// Cloud's identity provider — folds the three former `protected.ts` resolvers +// (`resolveApiKeyPrincipal`, `resolveSessionPrincipal`, `resolveProtectedPrincipal`) +// into one `authenticate(request)` that the shared `ExecutionStackMiddleware` +// consumes. The credential precedence (Bearer api-key BEATS sealed-session +// cookie) stays INSIDE this adapter — it is WorkOS-specific and deliberately not +// abstracted into the shared seam. +// +// Cloud now provides the NEUTRAL `IdentityProvider` tag (same as self-host), not +// a forked one. Each rejected path raises the SHARED identity error carrying the +// SAME machine `code` + `message` it always emitted, so cloud's failure strategy +// reproduces the exact `{ error, code }` JSON bytes at the SAME status: +// - non-Bearer header -> Unauthorized 401 invalid_authorization_header +// - empty Bearer token -> Unauthorized 401 invalid_api_key +// - api-key validate outage -> Unavailable 503 api_key_validation_unavailable +// - invalid api key -> Unauthorized 401 invalid_api_key +// - api-key org not authorized -> NoOrganization 403 no_organization +// - no/invalid session -> NoOrganization 403 no_organization +// - session org not authorized -> NoOrganization 403 no_organization +// - no auth header -> falls through to the sealed-session path +// The org-resolution infra errors (`UserStoreError` / `WorkOSError`) are +// `Effect.die`d so they surface as 500 defects — the same status the old inline +// resolver produced when those bubbled up. +// +// The per-request `UserStoreService` (read by the org-resolution path) stays a +// REQUIREMENT OF THE LAYER, satisfied by the facade's per-request DB combine — +// NOT a function-level requirement (that is what forced a forked tag before). +// --------------------------------------------------------------------------- + +import { Effect, Layer } from "effect"; +import { HttpServerResponse } from "effect/unstable/http"; + +import { + IdentityProvider, + NoOrganization, + Unauthorized, + Unavailable, +} from "@executor-js/api/server"; +import type { FailureRenderingStrategy, IdentityFailure, Principal } from "@executor-js/api/server"; + +import { ApiKeyService } from "./api-keys"; +import { BEARER_PREFIX } from "./bearer"; +import { authorizeOrganization } from "./organization"; +import { UserStoreService } from "./context"; +import { sealedSessionDisplayName } from "./middleware"; +import type { UserStoreError, WorkOSError } from "./errors"; +import { WorkOSClient } from "./workos"; + +// The exact machine codes + messages each rejected path has always emitted. +// Carried on the shared identity error so the failure strategy renders the +// byte-identical `{ error, code }` body. +const INVALID_AUTHORIZATION_HEADER = { + code: "invalid_authorization_header", + message: "Authorization header must use Bearer authentication", +}; +const INVALID_API_KEY = { code: "invalid_api_key", message: "Invalid API key" }; +const API_KEY_VALIDATION_UNAVAILABLE = { + code: "api_key_validation_unavailable", + message: "API key validation is temporarily unavailable", +}; +const NO_ORGANIZATION_IN_API_KEY = { + code: "no_organization", + message: "No organization in API key", +}; +const NO_ORGANIZATION_IN_SESSION = { + code: "no_organization", + message: "No organization in session", +}; + +export const resolveApiKeyPrincipal = (request: Request) => + Effect.gen(function* () { + const authHeader = request.headers.get("authorization"); + if (!authHeader) return null; + + if (!authHeader.startsWith(BEARER_PREFIX)) { + return yield* new Unauthorized(INVALID_AUTHORIZATION_HEADER); + } + + const value = authHeader.slice(BEARER_PREFIX.length).trim(); + if (!value) return yield* new Unauthorized(INVALID_API_KEY); + + const apiKeys = yield* ApiKeyService; + const principal = yield* apiKeys + .validate(value) + .pipe( + Effect.catchTag("ApiKeyValidationError", () => + Effect.fail(new Unavailable(API_KEY_VALIDATION_UNAVAILABLE)), + ), + ); + + if (!principal) return yield* new Unauthorized(INVALID_API_KEY); + + const org = yield* authorizeOrganization(principal.accountId, principal.organizationId); + if (!org) return yield* new NoOrganization(NO_ORGANIZATION_IN_API_KEY); + + return { + accountId: principal.accountId, + organizationId: org.id, + organizationName: org.name, + email: "", + name: null, + avatarUrl: null, + roles: [], + } satisfies Principal; + }); + +export const resolveSessionPrincipal = (request: Request) => + Effect.gen(function* () { + const workos = yield* WorkOSClient; + const session = yield* workos.authenticateRequest(request); + if (!session || !session.organizationId) { + return yield* new NoOrganization(NO_ORGANIZATION_IN_SESSION); + } + const org = yield* authorizeOrganization(session.userId, session.organizationId); + if (!org) return yield* new NoOrganization(NO_ORGANIZATION_IN_SESSION); + return { + accountId: session.userId, + organizationId: org.id, + organizationName: org.name, + email: session.email, + name: sealedSessionDisplayName(session), + avatarUrl: session.avatarUrl ?? null, + roles: [], + } satisfies Principal; + }); + +/** + * Resolve to the neutral `Principal` (api-key BEATS sealed-session). Cloud has + * no roles to resolve, so each leaf already carries `roles: []`. Raises the + * SHARED identity errors directly (`Unauthorized | NoOrganization | Unavailable`, + * each carrying its machine `code` + `message`); the org-resolution infra errors + * (`UserStoreError` / `WorkOSError`) bubble for `workosIdentityLayer` to `die`. + * Keeps `WorkOSClient` / `ApiKeyService` / `UserStoreService` as requirements (the + * org-resolution path reads them) so it stays request-scoped. Re-exported for + * `protected-api-key-auth.node.test.ts`, which asserts the per-path principal + + * shared error codes this folded resolver emits. + */ +export const resolveProtectedPrincipal = ( + request: Request, +): Effect.Effect< + Principal, + Unauthorized | NoOrganization | Unavailable | UserStoreError | WorkOSError, + WorkOSClient | ApiKeyService | UserStoreService +> => + Effect.gen(function* () { + const apiKeyPrincipal = yield* resolveApiKeyPrincipal(request); + if (apiKeyPrincipal) return apiKeyPrincipal; + return yield* resolveSessionPrincipal(request); + }); + +/** + * Cloud's NEUTRAL `IdentityProvider` Layer. Closes over the long-lived + * `WorkOSClient` + `ApiKeyService`; the request-scoped `UserStoreService` stays a + * REQUIREMENT OF THE LAYER, satisfied per request by the facade's DB combine. + * `authenticate` matches the neutral shape exactly (`Effect`): rejected credentials already + * carry the shared errors; the org-resolution infra errors (`UserStoreError` / + * `WorkOSError`) are `Effect.die`d so they surface as 500 defects, never on the + * error channel. + */ +export const workosIdentityLayer: Layer.Layer< + IdentityProvider, + never, + WorkOSClient | ApiKeyService | UserStoreService +> = Layer.effect( + IdentityProvider, + Effect.gen(function* () { + const context = yield* Effect.context(); + return IdentityProvider.of({ + authenticate: (request) => + resolveProtectedPrincipal(request).pipe( + // `UserStoreError` / `WorkOSError` are org-resolution infra failures — + // surface as a 500 defect, exactly as the old inline resolver let them + // bubble. The narrow `die` here is the runtime edge for that infra + // failure; the shared identity errors stay typed on the channel. + Effect.catchTags({ + // oxlint-disable-next-line executor/no-effect-escape-hatch -- boundary: org-resolution infra failure -> 500 defect, matches prior inline-resolver behavior + UserStoreError: (error) => Effect.die(error), + // oxlint-disable-next-line executor/no-effect-escape-hatch -- boundary: org-resolution infra failure -> 500 defect, matches prior inline-resolver behavior + WorkOSError: (error) => Effect.die(error), + }), + Effect.provide(context), + ), + }); + }), +); + +// Render a shared identity failure as cloud's exact `{ error, code }` JSON body +// at the given status. `code` + `message` ride on the shared error (cloud always +// supplies both); the defaults only guard the self-host-produced bare errors. +const renderIdentityFailure = + (status: number, fallbackCode: string, fallbackMessage: string) => + (failure: { readonly code?: string; readonly message?: string }) => + Effect.succeed( + HttpServerResponse.jsonUnsafe( + { + error: failure.message ?? fallbackMessage, + code: failure.code ?? fallbackCode, + }, + { status }, + ), + ); + +/** + * Cloud's failure-rendering STRATEGY. Where self-host's `textFailureStrategy` + * renders the shared identity errors as plain text, cloud renders them as its + * exact `{ error, code }` JSON at 401 / 403 / 503 — BYTE-IDENTICAL to the old + * `HttpResponseError` responses. The `code` + `message` carried on each shared + * error reproduce the precise body; the tag fixes the status. + */ +export const cloudIdentityFailureStrategy: FailureRenderingStrategy = { + renderFailure: (effect) => + effect.pipe( + Effect.catchTags({ + Unauthorized: renderIdentityFailure(401, "unauthorized", "Unauthorized"), + NoOrganization: renderIdentityFailure(403, "no_organization", "No organization"), + Unavailable: renderIdentityFailure( + 503, + "service_unavailable", + "Service temporarily unavailable", + ), + }), + ), +}; diff --git a/apps/cloud/src/auth/workos.test-layer.ts b/apps/cloud/src/auth/workos.test-layer.ts index d2d7f97da..6b111367d 100644 --- a/apps/cloud/src/auth/workos.test-layer.ts +++ b/apps/cloud/src/auth/workos.test-layer.ts @@ -1,7 +1,7 @@ import { Data, Effect, Layer } from "effect"; import type { Organization, OrganizationMembership, OrganizationRole } from "@workos-inc/node"; -import { WorkOSAuth, type WorkOSCollectedList } from "./workos"; +import { WorkOSClient, type WorkOSCollectedList } from "./workos"; export type WorkOSTestState = { readonly memberships: readonly OrganizationMembership[]; @@ -76,9 +76,9 @@ const collected = (data: readonly A[]): WorkOSCollectedList => ({ }, }); -const makeWorkOSTestService = (state: WorkOSTestState): WorkOSAuth["Service"] => { +const makeWorkOSTestService = (state: WorkOSTestState): WorkOSClient["Service"] => { const nextOrgId = "org_created"; - const service: Partial = { + const service: Partial = { listUserMemberships: () => Effect.succeed(collected(state.memberships)), createOrganization: (name) => Effect.sync(() => { @@ -105,7 +105,7 @@ const makeWorkOSTestService = (state: WorkOSTestState): WorkOSAuth["Service"] => }), }; - return new Proxy(service as WorkOSAuth["Service"], { + return new Proxy(service as WorkOSClient["Service"], { get: (target, prop) => { if (prop in target) return target[prop as keyof typeof target]; return () => @@ -119,4 +119,4 @@ const makeWorkOSTestService = (state: WorkOSTestState): WorkOSAuth["Service"] => }; export const WorkOSTestLayer = (state: WorkOSTestState) => - Layer.succeed(WorkOSAuth)(makeWorkOSTestService(state)); + Layer.succeed(WorkOSClient)(makeWorkOSTestService(state)); diff --git a/apps/cloud/src/auth/workos.ts b/apps/cloud/src/auth/workos.ts index 1b539fe49..abf04b666 100644 --- a/apps/cloud/src/auth/workos.ts +++ b/apps/cloud/src/auth/workos.ts @@ -106,7 +106,7 @@ export const collectRawWorkOSList = async ( }; }; -class WorkOSAuthConfigurationError extends Data.TaggedError("WorkOSAuthConfigurationError")<{ +class WorkOSConfigurationError extends Data.TaggedError("WorkOSConfigurationError")<{ readonly message: string; }> {} @@ -120,7 +120,7 @@ const make = Effect.gen(function* () { const cookiePassword = env.WORKOS_COOKIE_PASSWORD; if (!cookiePassword || cookiePassword.length < 32) { - return yield* new WorkOSAuthConfigurationError({ + return yield* new WorkOSConfigurationError({ message: INVALID_COOKIE_PASSWORD_MESSAGE, }); } @@ -403,13 +403,13 @@ const make = Effect.gen(function* () { }; }); -export type WorkOSAuthService = Effect.Success; +export type WorkOSClientService = Effect.Success; -export class WorkOSAuth extends Context.Service()( - "@executor-js/cloud/WorkOSAuth", +export class WorkOSClient extends Context.Service()( + "@executor-js/cloud/WorkOSClient", ) { static Default = Layer.effect(this)(make).pipe( - Layer.withSpan("WorkOSAuth", { attributes: { module: "WorkOSAuth" } }), + Layer.withSpan("WorkOSClient", { attributes: { module: "WorkOSClient" } }), ); } diff --git a/apps/cloud/src/edge/index.ts b/apps/cloud/src/edge/index.ts new file mode 100644 index 000000000..831992882 --- /dev/null +++ b/apps/cloud/src/edge/index.ts @@ -0,0 +1,10 @@ +// --------------------------------------------------------------------------- +// Edge concerns — the analytics/marketing request middlewares that run at the +// worker edge BEFORE the app's own mcp + api dispatch. None of these touch the +// Effect app layer; they proxy or tunnel to external services (the marketing +// worker, Sentry, PostHog). +// --------------------------------------------------------------------------- + +export { marketingMiddleware } from "./marketing"; +export { sentryTunnelMiddleware } from "./sentry-tunnel"; +export { posthogProxyMiddleware } from "./posthog"; diff --git a/apps/cloud/src/edge/marketing.ts b/apps/cloud/src/edge/marketing.ts new file mode 100644 index 000000000..8d039c982 --- /dev/null +++ b/apps/cloud/src/edge/marketing.ts @@ -0,0 +1,63 @@ +// --------------------------------------------------------------------------- +// Marketing routes — proxied to the marketing worker via service binding. +// +// On the production domain (`executor.sh`), marketing paths and the +// unauthenticated landing page are served by the separate `executor-marketing` +// worker (bound as `env.MARKETING`). In local dev that worker isn't running, so +// unauthenticated visits fall through to the cloud app's routes (the sign-in +// page). +// --------------------------------------------------------------------------- + +import { env } from "cloudflare:workers"; +import { createMiddleware } from "@tanstack/react-start"; + +const MARKETING_PATHS = [ + "/home", + "/setup", + "/privacy", + "/terms", + "/api/detect", + "/_astro", + "/og-image.png", + "/pattern-graph-paper.svg", +]; + +const isMarketingPath = (pathname: string) => + MARKETING_PATHS.some((p) => pathname === p || pathname.startsWith(`${p}/`)); + +const getMarketingWorker = () => env.MARKETING as { fetch: typeof fetch } | undefined; + +const parseCookie = (cookieHeader: string | null, name: string): string | null => { + if (!cookieHeader) return null; + const match = cookieHeader + .split(";") + .map((v) => v.trim()) + .find((v) => v.startsWith(`${name}=`)); + return match ? match.slice(name.length + 1) || null : null; +}; + +export const marketingMiddleware = createMiddleware({ type: "request" }).server( + async ({ pathname, request, next }) => { + // Only proxy to the marketing worker on the production domain. In local + // dev we don't run `executor-marketing`, so unauthenticated visits fall + // through to the cloud app's routes (which show the sign-in page). + const host = new URL(request.url).hostname; + if (host !== "executor.sh") return next(); + + const shouldProxyToMarketing = + isMarketingPath(pathname) || + (pathname === "/" && !parseCookie(request.headers.get("cookie"), "wos-session")); + + if (!shouldProxyToMarketing) return next(); + + const marketing = getMarketingWorker(); + if (!marketing) return next(); + + const url = new URL(request.url); + // Rewrite /home to / so marketing worker serves its homepage + if (pathname === "/home") { + url.pathname = "/"; + } + return marketing.fetch(new Request(url, request)); + }, +); diff --git a/apps/cloud/src/edge/posthog.ts b/apps/cloud/src/edge/posthog.ts new file mode 100644 index 000000000..6badd574f --- /dev/null +++ b/apps/cloud/src/edge/posthog.ts @@ -0,0 +1,35 @@ +// --------------------------------------------------------------------------- +// PostHog reverse proxy — the browser SDK targets a build-randomized +// first-party path and we forward to PostHog's ingest + asset hosts. Keeps +// events flowing past adblockers that match *.posthog.com. See +// https://posthog.com/docs/advanced/proxy/cloudflare +// --------------------------------------------------------------------------- + +import { createMiddleware } from "@tanstack/react-start"; + +const POSTHOG_INGEST_HOST = "us.i.posthog.com"; +const POSTHOG_ASSETS_HOST = "us-assets.i.posthog.com"; +const POSTHOG_PROXY_PATH = `/api/${(import.meta.env.VITE_PUBLIC_ANALYTICS_PATH ?? "a").replace( + /^\/+|\/+$/g, + "", +)}`; + +export const posthogProxyMiddleware = createMiddleware({ type: "request" }).server( + ({ pathname, request, next }) => { + if (pathname !== POSTHOG_PROXY_PATH && !pathname.startsWith(`${POSTHOG_PROXY_PATH}/`)) { + return next(); + } + + const url = new URL(request.url); + url.hostname = pathname.startsWith(`${POSTHOG_PROXY_PATH}/static/`) + ? POSTHOG_ASSETS_HOST + : POSTHOG_INGEST_HOST; + url.protocol = "https:"; + url.port = ""; + url.pathname = pathname.slice(POSTHOG_PROXY_PATH.length) || "/"; + + const upstream = new Request(url, request); + upstream.headers.delete("cookie"); + return fetch(upstream); + }, +); diff --git a/apps/cloud/src/sentry-tunnel.ts b/apps/cloud/src/edge/sentry-tunnel.ts similarity index 64% rename from apps/cloud/src/sentry-tunnel.ts rename to apps/cloud/src/edge/sentry-tunnel.ts index f63877444..acb656fa4 100644 --- a/apps/cloud/src/sentry-tunnel.ts +++ b/apps/cloud/src/edge/sentry-tunnel.ts @@ -1,3 +1,13 @@ +// --------------------------------------------------------------------------- +// Sentry tunnel — the browser SDK POSTs envelopes to /api/sentry-tunnel +// (configured in routes/__root.tsx) to dodge adblockers and CSP. We parse the +// envelope header to recover the DSN, validate against our own, and forward the +// body to Sentry's ingest endpoint. See +// https://docs.sentry.io/platforms/javascript/troubleshooting/#using-the-tunnel-option +// --------------------------------------------------------------------------- + +import { env } from "cloudflare:workers"; +import { createMiddleware } from "@tanstack/react-start"; import { Data, Effect, Schema } from "effect"; class SentryTunnelError extends Data.TaggedError("SentryTunnelError")<{ @@ -51,3 +61,16 @@ export const handleSentryTunnelRequest = (request: Request, configuredDsn: strin catch: (cause) => new SentryTunnelError({ cause }), }); }).pipe(Effect.catch(() => Effect.succeed(badSentryEnvelopeResponse()))); + +export const sentryTunnelMiddleware = createMiddleware({ type: "request" }).server( + ({ pathname, request, next }) => { + if (pathname !== "/api/sentry-tunnel" || request.method !== "POST") { + return next(); + } + + const configuredDsn = (env as { SENTRY_DSN?: string }).SENTRY_DSN; + if (!configuredDsn) return new Response(null, { status: 204 }); + + return Effect.runPromise(handleSentryTunnelRequest(request, configuredDsn)); + }, +); diff --git a/apps/cloud/src/env-augment.d.ts b/apps/cloud/src/env-augment.d.ts index e1c66a269..98cc0b3c7 100644 --- a/apps/cloud/src/env-augment.d.ts +++ b/apps/cloud/src/env-augment.d.ts @@ -20,6 +20,10 @@ declare global { DATABASE_URL?: string; EXECUTOR_DIRECT_DATABASE_URL?: string; + // SSRF / private-network egress guard. Unset in production -> the guard is + // ON; the test workers set "true" so fixtures can reach localhost. + ALLOW_LOCAL_NETWORK?: string; + // Billing AUTUMN_SECRET_KEY?: string; diff --git a/apps/cloud/src/mcp-auth.node.test.ts b/apps/cloud/src/mcp-auth.node.test.ts index 6e182441a..00df16c50 100644 --- a/apps/cloud/src/mcp-auth.node.test.ts +++ b/apps/cloud/src/mcp-auth.node.test.ts @@ -6,7 +6,7 @@ import { McpJwtVerificationError, verifyMcpAccessToken, verifyWorkOSMcpAccessToken, -} from "./mcp-auth"; +} from "./mcp/jwt"; const issuer = "https://test-authkit.example.com"; const resource = "https://test-resource.example.com/mcp"; diff --git a/apps/cloud/src/mcp-flow.test.ts b/apps/cloud/src/mcp-flow.test.ts index d395a3a65..cc426f01b 100644 --- a/apps/cloud/src/mcp-flow.test.ts +++ b/apps/cloud/src/mcp-flow.test.ts @@ -14,7 +14,7 @@ // Two auth seams are faked: `McpAuth.verifyBearer` and the live WorkOS // membership check. The real bearer impl calls WorkOS's JWKS endpoint, // which we can't reach from the test isolate. -// Test bearer format is `test-accept::::` +// Test bearer format is `test-accept::::` // (see `makeTestBearer` in test-worker.ts). // // The node-pool test (`mcp-session.e2e.node.test.ts`) covers the DO's @@ -165,7 +165,35 @@ describe("/mcp CORS preflight", () => { expect(allowedHeaders).toContain("mcp-session-id"); expect(allowedHeaders).toContain("authorization"); expect(allowedHeaders).toContain("content-type"); - expect(response.headers.get("access-control-expose-headers")).toBe("mcp-session-id"); + // Envelope canonical CORS superset: expose-headers now includes + // WWW-Authenticate alongside mcp-session-id. + const exposeHeaders = response.headers.get("access-control-expose-headers") ?? ""; + expect(exposeHeaders).toContain("mcp-session-id"); + }); +}); + +describe("/mcp method handling", () => { + it("returns 405 JSON-RPC -32001 for a method the transport doesn't serve", async () => { + // PUT/PATCH are not GET/POST/DELETE/OPTIONS — the envelope rejects them + // BEFORE dispatch so no session engine spins up (the OLD mcpApp 405). + for (const method of ["PUT", "PATCH"] as const) { + const response = await SELF.fetch(MCP_URL, { + method, + headers: { + authorization: `Bearer ${makeTestBearer(nextAccountId(), nextOrgId())}`, + "content-type": CONTENT_TYPE_JSON, + }, + body: JSON.stringify(TOOLS_LIST_REQUEST), + }); + expect(response.status, `${method} should be 405`).toBe(405); + const body = (await response.json()) as { + jsonrpc: string; + error: { code: number; message: string }; + }; + expect(body.jsonrpc).toBe("2.0"); + expect(body.error.code).toBe(-32001); + expect(body.error.message).toMatch(/method not allowed/i); + } }); }); @@ -187,6 +215,25 @@ describe("/.well-known/oauth-protected-resource", () => { scopes_supported: [], }); }); + + it("answers an OPTIONS CORS preflight on the discovery path with 204 + CORS", async () => { + // OLD mcpApp answered OPTIONS for ALL mcp paths (incl /.well-known/*) before + // the route switch; the envelope now registers an OPTIONS preflight per + // discovery path, not only /mcp. + const response = await SELF.fetch(OAUTH_RESOURCE_URL, { + method: "OPTIONS", + headers: { + origin: "https://claude.ai", + "access-control-request-method": "GET", + "access-control-request-headers": "authorization", + }, + }); + expect(response.status).toBe(204); + expect(response.headers.get("access-control-allow-origin")).toBe("*"); + expect(response.headers.get("access-control-allow-methods")).toBe("GET, POST, DELETE, OPTIONS"); + const allowedHeaders = response.headers.get("access-control-allow-headers") ?? ""; + expect(allowedHeaders).toContain("authorization"); + }); }); // --------------------------------------------------------------------------- @@ -204,7 +251,14 @@ describe("/mcp unauthorized", () => { expect(wwwAuth).toContain( "https://test-resource.example.com/.well-known/oauth-protected-resource/mcp", ); - expect(await response.json()).toEqual({ error: "unauthorized" }); + // Envelope canonicalizes the 401 body to a JSON-RPC error (the legacy + // `{ error: "unauthorized" }` body cannot be overridden through the shared + // envelope, which only lets the provider set the WWW-Authenticate challenge). + expect(await response.json()).toEqual({ + jsonrpc: "2.0", + error: { code: -32001, message: "Unauthorized" }, + id: null, + }); }); }); @@ -300,12 +354,12 @@ describe("/mcp unknown session id", () => { describe("/mcp notification responses", () => { it("returns 202 with an empty body for notifications/initialized", async () => { - const orgId = nextOrgId(); + const organizationId = nextOrgId(); const accountId = nextAccountId(); - await seedOrg(orgId); + await seedOrg(organizationId); const initializeResponse = await mcpPost({ - bearer: makeTestBearer(accountId, orgId), + bearer: makeTestBearer(accountId, organizationId), body: INITIALIZE_REQUEST, }); expect(initializeResponse.status).toBe(200); @@ -313,7 +367,7 @@ describe("/mcp notification responses", () => { expect(sessionId).toBeTruthy(); const notificationResponse = await mcpPost({ - bearer: makeTestBearer(accountId, orgId), + bearer: makeTestBearer(accountId, organizationId), sessionId, body: INITIALIZED_NOTIFICATION, }); @@ -326,12 +380,12 @@ describe("/mcp notification responses", () => { describe("/mcp session restore", () => { it("restores an initialized SDK transport from durable storage", async () => { - const orgId = nextOrgId(); + const organizationId = nextOrgId(); const accountId = nextAccountId(); - await seedOrg(orgId); + await seedOrg(organizationId); const initializeResponse = await mcpPost({ - bearer: makeTestBearer(accountId, orgId), + bearer: makeTestBearer(accountId, organizationId), body: INITIALIZE_REQUEST, }); expect(initializeResponse.status).toBe(200); @@ -345,7 +399,7 @@ describe("/mcp session restore", () => { }); const response = await mcpPost({ - bearer: makeTestBearer(accountId, orgId), + bearer: makeTestBearer(accountId, organizationId), sessionId, body: TOOLS_LIST_REQUEST, }); @@ -359,10 +413,10 @@ describe("/mcp session restore", () => { }, 15_000); it("keeps JSON POST responses after a session is restored by a GET reconnect", async () => { - const orgId = nextOrgId(); + const organizationId = nextOrgId(); const accountId = nextAccountId(); - const bearer = makeTestBearer(accountId, orgId); - await seedOrg(orgId); + const bearer = makeTestBearer(accountId, organizationId); + await seedOrg(organizationId); const initializeResponse = await mcpPost({ bearer, @@ -418,10 +472,10 @@ describe("/mcp session restore", () => { }, 15_000); it("restores an initialized session after the idle alarm suspends the runtime", async () => { - const orgId = nextOrgId(); + const organizationId = nextOrgId(); const accountId = nextAccountId(); - const bearer = makeTestBearer(accountId, orgId); - await seedOrg(orgId); + const bearer = makeTestBearer(accountId, organizationId); + await seedOrg(organizationId); const initializeResponse = await mcpPost({ bearer, @@ -493,14 +547,14 @@ describe("/mcp session restore", () => { }, 15_000); it("clears an existing session when live org access is revoked", async () => { - const orgId = `revoked_${nextOrgId()}`; + const organizationId = `revoked_${nextOrgId()}`; const accountId = nextAccountId(); const stub = env.MCP_SESSION.get(env.MCP_SESSION.newUniqueId()); const sessionId = stub.id.toString(); await runInDurableObject(stub, async (_instance, state) => { await state.storage.put(SESSION_META_KEY, { - organizationId: orgId, + organizationId, organizationName: "Revoked Org", userId: accountId, }); @@ -509,7 +563,7 @@ describe("/mcp session restore", () => { }); const revokedResponse = await mcpPost({ - bearer: makeTestBearer(accountId, orgId), + bearer: makeTestBearer(accountId, organizationId), sessionId, body: TOOLS_LIST_REQUEST, }); diff --git a/apps/cloud/src/mcp-miniflare.e2e.node.test.ts b/apps/cloud/src/mcp-miniflare.e2e.node.test.ts index 7686b8086..c84411d16 100644 --- a/apps/cloud/src/mcp-miniflare.e2e.node.test.ts +++ b/apps/cloud/src/mcp-miniflare.e2e.node.test.ts @@ -465,7 +465,14 @@ layer(TestEnv, { timeout: 60_000 })("cloud MCP over real HTTP (miniflare)", (it) "https://test-resource.example.com/.well-known/oauth-protected-resource/mcp", ); const body = yield* Effect.promise(() => response.json()); - expect(body).toEqual({ error: "unauthorized" }); + // Envelope canonicalizes the 401 body to a JSON-RPC error; the + // WWW-Authenticate challenge (asserted above) stays byte-for-byte via + // the provider's reason-sensitive Unauthorized.challenge. + expect(body).toEqual({ + jsonrpc: "2.0", + error: { code: -32001, message: "Unauthorized" }, + id: null, + }); }), 30_000, ); @@ -475,10 +482,10 @@ layer(TestEnv, { timeout: 60_000 })("cloud MCP over real HTTP (miniflare)", (it) () => Effect.gen(function* () { const { baseUrl, seedOrg } = yield* Worker; - const orgId = nextOrgId(); - yield* Effect.promise(() => seedOrg(orgId, "Miniflare Org")); + const organizationId = nextOrgId(); + yield* Effect.promise(() => seedOrg(organizationId, "Miniflare Org")); const client = yield* Effect.promise(() => - connectClient(baseUrl, makeTestBearer(nextAccountId(), orgId)), + connectClient(baseUrl, makeTestBearer(nextAccountId(), organizationId)), ); expect(client.getServerVersion()?.name).toBe("executor"); yield* Effect.promise(() => client.close()); @@ -491,10 +498,10 @@ layer(TestEnv, { timeout: 60_000 })("cloud MCP over real HTTP (miniflare)", (it) () => Effect.gen(function* () { const { baseUrl, seedOrg } = yield* Worker; - const orgId = nextOrgId(); - yield* Effect.promise(() => seedOrg(orgId, "List Tools Org")); + const organizationId = nextOrgId(); + yield* Effect.promise(() => seedOrg(organizationId, "List Tools Org")); const client = yield* Effect.promise(() => - connectClient(baseUrl, makeTestBearer(nextAccountId(), orgId)), + connectClient(baseUrl, makeTestBearer(nextAccountId(), organizationId)), ); const { tools } = yield* Effect.promise(() => client.listTools()); expect(tools.map((t) => t.name)).toContain("execute"); @@ -508,10 +515,10 @@ layer(TestEnv, { timeout: 60_000 })("cloud MCP over real HTTP (miniflare)", (it) () => Effect.gen(function* () { const { baseUrl, seedOrg } = yield* Worker; - const orgId = nextOrgId(); - yield* Effect.promise(() => seedOrg(orgId, "Execute Org")); + const organizationId = nextOrgId(); + yield* Effect.promise(() => seedOrg(organizationId, "Execute Org")); const client = yield* Effect.promise(() => - connectClient(baseUrl, makeTestBearer(nextAccountId(), orgId)), + connectClient(baseUrl, makeTestBearer(nextAccountId(), organizationId)), ); const result = yield* Effect.promise(() => client.callTool({ name: "execute", arguments: { code: "return 1 + 2" } }), @@ -529,9 +536,9 @@ layer(TestEnv, { timeout: 60_000 })("cloud MCP over real HTTP (miniflare)", (it) () => Effect.gen(function* () { const { baseUrl, seedOrg } = yield* Worker; - const orgId = nextOrgId(); - const bearer = makeTestBearer(nextAccountId(), orgId); - yield* Effect.promise(() => seedOrg(orgId, "Duplicate SSE Org")); + const organizationId = nextOrgId(); + const bearer = makeTestBearer(nextAccountId(), organizationId); + yield* Effect.promise(() => seedOrg(organizationId, "Duplicate SSE Org")); const sessionId = yield* Effect.promise(() => initializeSession(baseUrl, bearer)); const getHeaders = { @@ -562,9 +569,9 @@ layer(TestEnv, { timeout: 60_000 })("cloud MCP over real HTTP (miniflare)", (it) () => Effect.gen(function* () { const { baseUrl, seedOrg } = yield* Worker; - const orgId = nextOrgId(); - const bearer = makeTestBearer(nextAccountId(), orgId); - yield* Effect.promise(() => seedOrg(orgId, "Invalid SSE Replacement Org")); + const organizationId = nextOrgId(); + const bearer = makeTestBearer(nextAccountId(), organizationId); + yield* Effect.promise(() => seedOrg(organizationId, "Invalid SSE Replacement Org")); const sessionId = yield* Effect.promise(() => initializeSession(baseUrl, bearer)); const getHeaders = { @@ -607,9 +614,9 @@ layer(TestEnv, { timeout: 60_000 })("cloud MCP over real HTTP (miniflare)", (it) () => Effect.gen(function* () { const { baseUrl, seedOrg } = yield* Worker; - const orgId = nextOrgId(); - const bearer = makeTestBearer(nextAccountId(), orgId); - yield* Effect.promise(() => seedOrg(orgId, "SSE Reconnect Churn Org")); + const organizationId = nextOrgId(); + const bearer = makeTestBearer(nextAccountId(), organizationId); + yield* Effect.promise(() => seedOrg(organizationId, "SSE Reconnect Churn Org")); const sessionId = yield* Effect.promise(() => initializeSession(baseUrl, bearer)); const getHeaders = { @@ -688,9 +695,9 @@ layer(TestEnv, { timeout: 60_000 })("cloud MCP over real HTTP (miniflare)", (it) () => Effect.gen(function* () { const { baseUrl, seedOrg } = yield* Worker; - const orgId = nextOrgId(); - const bearer = makeTestBearer(nextAccountId(), orgId); - yield* Effect.promise(() => seedOrg(orgId, "Overlapping Request Id Org")); + const organizationId = nextOrgId(); + const bearer = makeTestBearer(nextAccountId(), organizationId); + yield* Effect.promise(() => seedOrg(organizationId, "Overlapping Request Id Org")); const sessionId = yield* Effect.promise(() => initializeSession(baseUrl, bearer)); const postExecute = (code: string) => @@ -757,11 +764,11 @@ layer(TestEnv, { timeout: 60_000 })("cloud MCP over real HTTP (miniflare)", (it) Effect.gen(function* () { const { baseUrl, seedOrg } = yield* Worker; const { baseUrl: upstreamBaseUrl, specJson } = yield* Upstream; - const orgId = nextOrgId(); - yield* Effect.promise(() => seedOrg(orgId, "Elicit Org")); + const organizationId = nextOrgId(); + yield* Effect.promise(() => seedOrg(organizationId, "Elicit Org")); const client = yield* Effect.promise(() => - connectClient(baseUrl, makeTestBearer(nextAccountId(), orgId), { + connectClient(baseUrl, makeTestBearer(nextAccountId(), organizationId), { withElicitation: true, elicitationMode: "native", }), @@ -807,10 +814,10 @@ layer(TestEnv, { timeout: 60_000 })("cloud MCP over real HTTP (miniflare)", (it) Effect.gen(function* () { const { baseUrl, seedOrg } = yield* Worker; const receiver = yield* TelemetryReceiver; - const orgId = nextOrgId(); - yield* Effect.promise(() => seedOrg(orgId, "Telemetry Org")); + const organizationId = nextOrgId(); + yield* Effect.promise(() => seedOrg(organizationId, "Telemetry Org")); const client = yield* Effect.promise(() => - connectClient(baseUrl, makeTestBearer(nextAccountId(), orgId)), + connectClient(baseUrl, makeTestBearer(nextAccountId(), organizationId)), ); // Trigger the DO through a multi-step flow so we can assert that // handleRequest spans are reported for every DO hit, not just init. @@ -850,17 +857,17 @@ layer(TestEnv, { timeout: 60_000 })("cloud MCP request-id telemetry", (it) => { Effect.gen(function* () { const { baseUrl, seedOrg } = yield* Worker; const receiver = yield* TelemetryReceiver; - const orgId = nextOrgId(); + const organizationId = nextOrgId(); const accountId = nextAccountId(); const requestId = `req_${crypto.randomUUID().replace(/-/g, "")}`; - yield* Effect.promise(() => seedOrg(orgId, "Request Id Org")); + yield* Effect.promise(() => seedOrg(organizationId, "Request Id Org")); const response = yield* Effect.promise(() => fetch(new URL("/mcp", baseUrl), { method: "POST", headers: { accept: "application/json, text/event-stream", - authorization: `Bearer ${makeTestBearer(accountId, orgId)}`, + authorization: `Bearer ${makeTestBearer(accountId, organizationId)}`, "content-type": "application/json", }, body: JSON.stringify({ diff --git a/apps/cloud/src/mcp-session.e2e.node.test.ts b/apps/cloud/src/mcp-session.e2e.node.test.ts index 7d7c5c488..781eb3f6c 100644 --- a/apps/cloud/src/mcp-session.e2e.node.test.ts +++ b/apps/cloud/src/mcp-session.e2e.node.test.ts @@ -21,15 +21,15 @@ import { InMemoryTransport } from "@modelcontextprotocol/sdk/inMemory.js"; import { ElicitRequestSchema } from "@modelcontextprotocol/sdk/types.js"; import type { ClientCapabilities } from "@modelcontextprotocol/sdk/types.js"; -import { createExecutorMcpServer } from "@executor-js/host-mcp"; +import { createExecutorMcpServer } from "@executor-js/host-mcp/tool-server"; import { createExecutionEngine } from "@executor-js/execution"; import { makeQuickJsExecutor } from "@executor-js/runtime-quickjs"; +import { collectTables } from "@executor-js/api/server"; import { ElicitationResponse, FormElicitation, Scope, ScopeId, - collectTables, createExecutor, definePlugin, } from "@executor-js/sdk"; @@ -130,12 +130,12 @@ const buildScopedExecutor = (scopeId: string, scopeName: string, options: BuildO // them connected to an in-memory MCP client. Shaped as an acquireRelease so // the transport teardown is guaranteed when the test scope closes. const openSession = ( - orgId: string, + organizationId: string, options: BuildOptions & { readonly caps?: ClientCapabilities } = {}, ) => Effect.acquireRelease( Effect.gen(function* () { - const executor = yield* buildScopedExecutor(orgId, `Org ${orgId}`, options); + const executor = yield* buildScopedExecutor(organizationId, `Org ${organizationId}`, options); const engine = createExecutionEngine({ executor, codeExecutor: makeQuickJsExecutor() }); const mcpServer = yield* createExecutorMcpServer({ engine, diff --git a/apps/cloud/src/mcp.ts b/apps/cloud/src/mcp.ts deleted file mode 100644 index c5ed3bac4..000000000 --- a/apps/cloud/src/mcp.ts +++ /dev/null @@ -1,815 +0,0 @@ -// --------------------------------------------------------------------------- -// Cloud MCP handler — Effect-native HTTP app for /mcp + /.well-known/* -// --------------------------------------------------------------------------- -// -// Built on Effect v4's unstable HTTP `HttpEffect.toWebHandler`. start.ts's -// mcpRequestMiddleware calls `mcpFetch` and falls through to `next()` when it -// returns `null` (non-MCP path) so TanStack Start keeps routing. -// -// Streaming passthrough — the MCP session Durable Object returns a `Response` -// whose body is a `ReadableStream` (SSE). We wrap that `Response` in -// `HttpServerResponse.raw(response)`; the platform's `toWeb` conversion -// recognises `body.body instanceof Response` and returns it as-is (only -// merging headers we set on the outer response, which is none), so the -// underlying `ReadableStream` passes through untouched. -// --------------------------------------------------------------------------- - -import { env } from "cloudflare:workers"; -import { HttpEffect, HttpServerRequest, HttpServerResponse } from "effect/unstable/http"; -import { Cause, Context, Effect, Layer, Match, Option, Predicate, Result, Schema } from "effect"; - -import { createCachedRemoteJWKSet } from "./jwks-cache"; -import { captureCause } from "./observability"; -import { TelemetryLive } from "./services/telemetry"; -import { - McpJwtVerificationError, - verifyWorkOSMcpAccessToken, - type VerifiedToken, -} from "./mcp-auth"; -import { ApiKeyService } from "./auth/api-keys"; -import { authorizeOrganization } from "./auth/authorize-organization"; -import { UserStoreService } from "./auth/context"; -import { CoreSharedServices } from "./api/core-shared-services"; -import { DbService } from "./services/db"; -import { peekAndAnnotate } from "./mcp/response-peek"; -import { - authTemporarilyUnavailable, - CORS_ALLOW_ORIGIN, - jsonResponse, - jsonRpcError, - unauthorized, -} from "./mcp/responses"; - -// --------------------------------------------------------------------------- -// Constants -// --------------------------------------------------------------------------- - -const AUTHKIT_DOMAIN = env.MCP_AUTHKIT_DOMAIN ?? "https://signin.executor.sh"; -const RESOURCE_ORIGIN = env.MCP_RESOURCE_ORIGIN ?? "https://executor.sh"; -const WORKOS_CLIENT_ID = env.WORKOS_CLIENT_ID; - -// Module-scope cache survives across MCP requests within the same worker -// isolate. AuthKit's JWKS rotates on the order of hours/days, so a 1h TTL -// dominates the upstream cooldown without sacrificing rotation safety — -// `createCachedRemoteJWKSet` force-refreshes on key-not-found inside its -// resolver. Production telemetry showed ~222 fetches/8h with p99 1.7s on -// the previous default-cooldown setup; this collapses that to ~1 per -// isolate-hour. -const jwks = createCachedRemoteJWKSet(new URL(`${AUTHKIT_DOMAIN}/oauth2/jwks`)); - -const BEARER_PREFIX = "Bearer "; -const INTERNAL_ACCOUNT_ID_HEADER = "x-executor-mcp-account-id"; -const INTERNAL_ORGANIZATION_ID_HEADER = "x-executor-mcp-organization-id"; - -const CORS_PREFLIGHT_HEADERS = { - ...CORS_ALLOW_ORIGIN, - "access-control-allow-methods": "GET, POST, DELETE, OPTIONS", - "access-control-allow-headers": - "authorization, content-type, mcp-session-id, accept, mcp-protocol-version", - "access-control-expose-headers": "mcp-session-id", -} as const; - -const TRUE_QUERY_VALUES = new Set(["1", "true", "yes", "on"]); - -const MCP_PATH = "/mcp"; -const PROTECTED_RESOURCE_METADATA_PATH = "/.well-known/oauth-protected-resource/mcp"; -const PROTECTED_RESOURCE_METADATA_URL = `${RESOURCE_ORIGIN}${PROTECTED_RESOURCE_METADATA_PATH}`; -const RESOURCE_URL = `${RESOURCE_ORIGIN}${MCP_PATH}`; - -type McpUnauthorizedReason = "missing_bearer" | "invalid_token"; - -type McpAuthorizedResult = { - readonly _tag: "Authorized"; - readonly token: VerifiedToken; -}; - -type McpUnauthorizedResult = { - readonly _tag: "Unauthorized"; - readonly reason: McpUnauthorizedReason; - readonly description?: string; -}; - -export type McpAuthResult = McpAuthorizedResult | McpUnauthorizedResult; - -export const mcpAuthorized = (token: VerifiedToken): McpAuthorizedResult => ({ - _tag: "Authorized", - token, -}); - -export const mcpUnauthorized = ( - reason: McpUnauthorizedReason, - description?: string, -): McpUnauthorizedResult => ({ - _tag: "Unauthorized", - reason, - description, -}); - -const corsPreflight = HttpServerResponse.empty({ - status: 204, - headers: CORS_PREFLIGHT_HEADERS, -}); - -// --------------------------------------------------------------------------- -// Auth -// --------------------------------------------------------------------------- - -export class McpAuth extends Context.Service< - McpAuth, - { - readonly verifyBearer: ( - request: Request, - ) => Effect.Effect; - } ->()("@executor-js/cloud/McpAuth") {} - -export class McpOrganizationAuth extends Context.Service< - McpOrganizationAuth, - { - readonly authorize: ( - accountId: string, - organizationId: string, - ) => Effect.Effect; - } ->()("@executor-js/cloud/McpOrganizationAuth") {} - -const verifyJwt = (token: string) => - verifyWorkOSMcpAccessToken(token, jwks, { - issuer: AUTHKIT_DOMAIN, - audience: WORKOS_CLIENT_ID, - }); - -const DbLive = DbService.Live; -const UserStoreLive = UserStoreService.Live.pipe(Layer.provide(DbLive)); -const McpOrganizationAuthServices = Layer.mergeAll(DbLive, UserStoreLive, CoreSharedServices); - -export const McpOrganizationAuthLive = Layer.succeed(McpOrganizationAuth)({ - authorize: (accountId, organizationId) => - authorizeOrganization(accountId, organizationId).pipe( - Effect.map((org) => org !== null), - Effect.provide(McpOrganizationAuthServices), - ), -}); - -const looksLikeJwt = (token: string): boolean => token.split(".").length === 3; - -export const McpAuthLive = Layer.effect( - McpAuth, - Effect.gen(function* () { - const apiKeys = yield* ApiKeyService; - - const verifyApiKey = Effect.fn("mcp.auth.verify_api_key")(function* (token: string) { - const principal = yield* apiKeys.validate(token).pipe( - Effect.catchTag("ApiKeyValidationError", (error) => - Effect.fail( - new McpJwtVerificationError({ - cause: error.cause, - reason: "system", - }), - ), - ), - ); - if (!principal) { - yield* Effect.annotateCurrentSpan({ - "mcp.auth.outcome": "invalid", - "mcp.auth.invalid_reason": "api_key", - }); - return mcpUnauthorized("invalid_token", "The API key is invalid"); - } - - yield* Effect.annotateCurrentSpan({ - "mcp.auth.outcome": "verified", - "mcp.auth.credential_type": "api_key", - "mcp.auth.has_organization": true, - }); - return mcpAuthorized({ - accountId: principal.accountId, - organizationId: principal.organizationId, - }); - }); - - const verifyJwtBearer = Effect.fn("mcp.auth.verify_jwt_bearer")(function* (token: string) { - const verified = yield* verifyJwt(token).pipe( - Effect.catchTag("McpJwtVerificationError", (error) => { - if (error.reason === "system") return Effect.fail(error); - return Effect.gen(function* () { - yield* Effect.annotateCurrentSpan({ - "mcp.auth.outcome": "invalid", - "mcp.auth.invalid_reason": error.reason, - }); - return mcpUnauthorized( - "invalid_token", - error.reason === "expired" - ? "The access token expired" - : "The access token is invalid", - ); - }); - }), - ); - if (!verified) return mcpUnauthorized("invalid_token", "The access token is invalid"); - if (Predicate.isTagged(verified, "Unauthorized")) return verified; - if (!verified.accountId) { - yield* Effect.annotateCurrentSpan({ "mcp.auth.outcome": "missing_subject" }); - return mcpUnauthorized("invalid_token", "The access token is invalid"); - } - yield* Effect.annotateCurrentSpan({ - "mcp.auth.outcome": "verified", - "mcp.auth.credential_type": "jwt", - "mcp.auth.has_organization": !!verified.organizationId, - }); - return mcpAuthorized(verified); - }); - - return { - verifyBearer: Effect.fn("mcp.auth.verify_bearer")(function* (request) { - const authHeader = request.headers.get("authorization"); - if (!authHeader?.startsWith(BEARER_PREFIX)) { - yield* Effect.annotateCurrentSpan({ "mcp.auth.outcome": "missing_bearer" }); - return mcpUnauthorized("missing_bearer"); - } - const token = authHeader.slice(BEARER_PREFIX.length).trim(); - if (!token) return mcpUnauthorized("invalid_token", "The bearer token is invalid"); - return yield* looksLikeJwt(token) ? verifyJwtBearer(token) : verifyApiKey(token); - }), - }; - }), -); - -// --------------------------------------------------------------------------- -// Client fingerprint capture -// --------------------------------------------------------------------------- -// Annotates the Effect span with everything we can learn about a connecting MCP client: the -// parsed JSON-RPC body, whitelisted request headers, CF request metadata, -// and verified-JWT claims. Lets us compare how each client (Claude Code, -// Claude.ai web, ChatGPT, custom scripts, ...) actually reports over the -// wire. Runs before dispatch so unauthorized requests still get fingerprinted. -// --------------------------------------------------------------------------- - -type CfRequestMetadata = { - country?: string; - city?: string; - region?: string; - timezone?: string; - asn?: number; - asOrganization?: string; - tlsVersion?: string; - tlsCipher?: string; - httpProtocol?: string; - colo?: string; -}; - -const requestWithCf = (request: Request): Request & { cf?: CfRequestMetadata } => - request as Request & { cf?: CfRequestMetadata }; - -const getCfMeta = (request: Request): CfRequestMetadata => requestWithCf(request).cf ?? {}; - -const HEADERS_TO_DUMP = [ - "accept", - "accept-encoding", - "accept-language", - "cache-control", - "content-type", - "mcp-protocol-version", - "origin", - "referer", - "sec-fetch-dest", - "sec-fetch-mode", - "sec-fetch-site", - "user-agent", - "x-client-name", - "x-client-version", - "x-requested-with", -] as const; - -const dumpHeaders = (request: Request): Record => { - const out: Record = {}; - for (const name of HEADERS_TO_DUMP) { - const value = request.headers.get(name); - if (value !== null) out[`mcp.http.header.${name}`] = value; - } - const authHeader = request.headers.get("authorization"); - if (authHeader) { - out["mcp.http.header.authorization.scheme"] = authHeader.split(" ", 1)[0] ?? ""; - out["mcp.http.header.authorization.length"] = String(authHeader.length); - } - // Record the full header name list too — surfaces anything unexpected - // without us having to enumerate every possibility up front. - out["mcp.http.header.names"] = Array.from(request.headers.keys()).sort().join(","); - return out; -}; - -// JSON-RPC shapes — narrow to just the fields we fingerprint. Using Schema -// collapses the typeof-guard pile and surfaces "what does an MCP client -// actually send us" as declarative types. Unknown/malformed input decodes -// to None and contributes no span attrs. - -const UnknownRecord = Schema.Record(Schema.String, Schema.Unknown); - -const JsonRpcEnvelope = Schema.Struct({ - method: Schema.optional(Schema.String), - id: Schema.optional(Schema.Union([Schema.String, Schema.Number, Schema.Null])), - params: Schema.optional(UnknownRecord), - // Responses to server-initiated requests arrive as POST bodies too — - // notably elicitation replies (`result.action = "accept" | "decline" | "cancel"`). - result: Schema.optional(UnknownRecord), -}); -type JsonRpcEnvelope = typeof JsonRpcEnvelope.Type; - -const ElicitationReplyResult = Schema.Struct({ - action: Schema.optional(Schema.Literals(["accept", "decline", "cancel"])), -}); - -const InitializeParams = Schema.Struct({ - protocolVersion: Schema.optional(Schema.String), - clientInfo: Schema.optional( - Schema.Struct({ - name: Schema.optional(Schema.String), - version: Schema.optional(Schema.String), - title: Schema.optional(Schema.String), - }), - ), - capabilities: Schema.optional(UnknownRecord), -}); - -const NamedParams = Schema.Struct({ name: Schema.optional(Schema.String) }); -const UriParams = Schema.Struct({ uri: Schema.optional(Schema.String) }); - -const decodeJsonRpcEnvelopeString = Schema.decodeUnknownOption( - Schema.fromJsonString(JsonRpcEnvelope), -); -const decodeInitializeParams = Schema.decodeUnknownOption(InitializeParams); -const decodeNamedParams = Schema.decodeUnknownOption(NamedParams); -const decodeUriParams = Schema.decodeUnknownOption(UriParams); -const decodeElicitationReplyResult = Schema.decodeUnknownOption(ElicitationReplyResult); - -const isMcpAuthorized = (value: McpAuthResult): value is McpAuthorizedResult => - Predicate.isTagged(value, "Authorized"); -const isMcpUnauthorized = (value: McpAuthResult): value is McpUnauthorizedResult => - Predicate.isTagged(value, "Unauthorized"); - -const readJsonRpcEnvelope = (request: Request): Effect.Effect> => - Effect.tryPromise({ - try: () => request.clone().text(), - catch: () => undefined, - }).pipe( - Effect.map((text) => (text ? decodeJsonRpcEnvelopeString(text) : Option.none())), - Effect.catchCause(() => Effect.succeed(Option.none())), - Effect.withSpan("mcp.request.read_json_rpc"), - ); - -const methodAttrs = (envelope: JsonRpcEnvelope): Record => { - const params = envelope.params ?? {}; - return Match.value(envelope.method).pipe( - Match.when("initialize", () => - Option.match(decodeInitializeParams(params), { - onNone: () => ({}) as Record, - onSome: (init) => ({ - ...(init.protocolVersion && { "mcp.client.protocol_version": init.protocolVersion }), - ...(init.clientInfo?.name && { "mcp.client.name": init.clientInfo.name }), - ...(init.clientInfo?.version && { "mcp.client.version": init.clientInfo.version }), - ...(init.clientInfo?.title && { "mcp.client.title": init.clientInfo.title }), - "mcp.client.capability.keys": Object.keys(init.capabilities ?? {}) - .sort() - .join(","), - }), - }), - ), - Match.when("tools/call", () => - Option.match(decodeNamedParams(params), { - onNone: () => ({}) as Record, - onSome: ({ name }) => (name ? { "mcp.tool.name": name } : {}), - }), - ), - Match.whenOr("resources/read", "resources/subscribe", () => - Option.match(decodeUriParams(params), { - onNone: () => ({}) as Record, - onSome: ({ uri }) => (uri ? { "mcp.resource.uri": uri } : {}), - }), - ), - Match.when("prompts/get", () => - Option.match(decodeNamedParams(params), { - onNone: () => ({}) as Record, - onSome: ({ name }) => (name ? { "mcp.prompt.name": name } : {}), - }), - ), - Match.option, - Option.getOrElse(() => ({}) as Record), - ); -}; - -const replyAttrs = (envelope: JsonRpcEnvelope): Record => { - if (!envelope.result || envelope.method) return {}; - return Option.match(decodeElicitationReplyResult(envelope.result), { - onNone: () => ({}), - onSome: ({ action }) => (action ? { "mcp.elicitation.action": action } : {}), - }); -}; - -const rpcAttrs = (envelope: Option.Option): Record => - Option.match(envelope, { - onNone: () => ({}), - onSome: (e) => ({ - ...(e.method && { "mcp.rpc.method": e.method }), - ...(e.id !== undefined && e.id !== null && { "mcp.rpc.id": String(e.id) }), - ...methodAttrs(e), - ...replyAttrs(e), - }), - }); - -const annotateMcpRequest = ( - request: Request, - opts: { token: VerifiedToken | null; parseBody: boolean }, -): Effect.Effect => - Effect.gen(function* () { - const cf = getCfMeta(request); - const baseAttrs: Record = { - "mcp.request.method": request.method, - "mcp.request.session_id_present": !!request.headers.get("mcp-session-id"), - "mcp.request.session_id": request.headers.get("mcp-session-id") ?? "", - "mcp.auth.has_bearer": (request.headers.get("authorization") ?? "").startsWith(BEARER_PREFIX), - "mcp.auth.verified": !!opts.token, - "mcp.auth.organization_id": opts.token?.organizationId ?? "", - "mcp.auth.account_id": opts.token?.accountId ?? "", - "cf.country": cf.country ?? "", - "cf.city": cf.city ?? "", - "cf.region": cf.region ?? "", - "cf.timezone": cf.timezone ?? "", - "cf.asn": cf.asn ?? 0, - "cf.as_organization": cf.asOrganization ?? "", - "cf.tls_version": cf.tlsVersion ?? "", - "cf.tls_cipher": cf.tlsCipher ?? "", - "cf.http_protocol": cf.httpProtocol ?? "", - "cf.colo": cf.colo ?? "", - ...dumpHeaders(request), - }; - - const envelope = opts.parseBody ? yield* readJsonRpcEnvelope(request) : Option.none(); - const attrs = { - ...baseAttrs, - ...rpcAttrs(envelope), - "mcp.request.parse_body": opts.parseBody, - }; - - yield* Effect.annotateCurrentSpan(attrs); - yield* Effect.annotateCurrentSpan(attrs).pipe(Effect.withSpan("mcp.request.annotate")); - }); - -// --------------------------------------------------------------------------- -// OAuth metadata endpoints -// --------------------------------------------------------------------------- - -const protectedResourceMetadata = Effect.sync(() => - jsonResponse({ - resource: RESOURCE_URL, - authorization_servers: [AUTHKIT_DOMAIN], - bearer_methods_supported: ["header"], - scopes_supported: [], - }), -); - -const authorizationServerMetadata = Effect.tryPromise({ - try: async () => { - const res = await fetch(`${AUTHKIT_DOMAIN}/.well-known/oauth-authorization-server`); - if (!res.ok) return jsonResponse({ error: "upstream_error" }, 502); - return jsonResponse(await res.json()); - }, - catch: () => undefined, -}).pipe(Effect.catchCause(() => Effect.succeed(jsonResponse({ error: "upstream_error" }, 502)))); - -// --------------------------------------------------------------------------- -// DO dispatch -// --------------------------------------------------------------------------- - -// Worker and DO run in separate isolates with independent WebSdk tracer -// providers. Neither one can see the other's OTEL context, so the DO used -// to emit a brand-new root trace on every stub call. Ferry the worker span -// context across with W3C headers: `traceparent` generated from the active -// Effect span plus passthrough `tracestate` / `baggage` from the inbound -// request. -type IncomingPropagationHeaders = { - readonly traceparent?: string; - readonly tracestate?: string; - readonly baggage?: string; -}; - -const currentTraceparent = Effect.map(Effect.currentSpan, (span) => { - if (!span || !span.traceId || !span.spanId) return undefined; - const flags = span.sampled ? "01" : "00"; - return `00-${span.traceId}-${span.spanId}-${flags}`; -}).pipe(Effect.orElseSucceed(() => undefined)); - -const currentPropagationHeaders = (request: Request): Effect.Effect => - Effect.map(currentTraceparent, (traceparent) => ({ - traceparent, - tracestate: request.headers.get("tracestate") ?? undefined, - baggage: request.headers.get("baggage") ?? undefined, - })); - -const withPropagationHeaders = ( - request: Request, - propagation: IncomingPropagationHeaders, -): Request => { - const headers = new Headers(request.headers); - if (propagation.traceparent) { - headers.set("traceparent", propagation.traceparent); - } - if (propagation.tracestate) { - headers.set("tracestate", propagation.tracestate); - } - if (propagation.baggage) { - headers.set("baggage", propagation.baggage); - } - return new Request(request, { headers }); -}; - -const withVerifiedIdentityHeaders = (request: Request, token: VerifiedToken): Request => { - const headers = new Headers(request.headers); - headers.set(INTERNAL_ACCOUNT_ID_HEADER, token.accountId); - headers.set(INTERNAL_ORGANIZATION_ID_HEADER, token.organizationId ?? ""); - return new Request(request, { headers }); -}; - -const withMcpResponseHeaders = (response: Response): Response => { - const headers = new Headers(response.headers); - headers.set("access-control-allow-origin", "*"); - headers.set("access-control-expose-headers", "mcp-session-id"); - return new Response(response.body, { - status: response.status, - statusText: response.statusText, - headers, - }); -}; - -type McpElicitationMode = "browser" | "model" | "native"; - -const MCP_ELICITATION_MODES = new Set(["browser", "model", "native"]); - -const readElicitationMode = (request: Request): McpElicitationMode => { - const url = new URL(request.url); - const mode = url.searchParams.get("elicitation_mode"); - if (mode && MCP_ELICITATION_MODES.has(mode as McpElicitationMode)) { - return mode as McpElicitationMode; - } - - const legacyModelResume = url.searchParams.get("allow_model_resume"); - if (legacyModelResume !== null && TRUE_QUERY_VALUES.has(legacyModelResume.toLowerCase())) { - return "model"; - } - - return "model"; -}; - -/** - * Forward a request to an existing session DO. Wrapping the DO's `Response` - * with `HttpServerResponse.raw` lets streaming bodies (SSE) pass through - * `HttpEffect.toWebHandler`'s conversion unchanged. - */ -const forwardToExistingSession = ( - request: Request, - sessionId: string, - peek: boolean, - token: VerifiedToken, -) => - Effect.gen(function* () { - const ns = env.MCP_SESSION; - const stub = ns.get(ns.idFromString(sessionId)); - const propagation = yield* currentPropagationHeaders(request); - const propagated = withPropagationHeaders( - withVerifiedIdentityHeaders(request, token), - propagation, - ); - const raw = yield* Effect.promise( - () => stub.handleRequest(propagated) as Promise, - ).pipe( - Effect.withSpan("mcp.do.handle_request", { - attributes: { - "mcp.request.method": request.method, - "mcp.request.session_id_present": true, - }, - }), - ); - const annotated = peek ? yield* peekAndAnnotate(raw) : raw; - return HttpServerResponse.raw(withMcpResponseHeaders(annotated)); - }); - -const clearExistingSession = (request: Request, sessionId: string) => - Effect.gen(function* () { - const ns = env.MCP_SESSION; - const stub = ns.get(ns.idFromString(sessionId)); - const propagation = yield* currentPropagationHeaders(request); - yield* Effect.promise(() => stub.clearSession(propagation) as Promise).pipe( - Effect.catchCause(() => Effect.void), - Effect.withSpan("mcp.do.clear_session", { - attributes: { "mcp.request.session_id_present": true }, - }), - ); - }); - -const authorizeMcpOrganization = ( - request: Request, - token: VerifiedToken, - sessionId: string | null, -) => - Effect.gen(function* () { - const organizationId = token.organizationId; - if (!organizationId) { - return jsonRpcError(403, -32001, "No organization in session — log in via the web app first"); - } - - const auth = yield* McpOrganizationAuth; - const allowed = yield* auth.authorize(token.accountId, organizationId).pipe( - Effect.catchCause((error) => - Effect.gen(function* () { - yield* Effect.annotateCurrentSpan({ - "mcp.auth.organization_authorize_error": Cause.pretty(error), - }); - return false; - }), - ), - Effect.withSpan("mcp.auth.authorize_organization", { - attributes: { "mcp.auth.organization_id": organizationId }, - }), - ); - if (allowed) return null; - - if (sessionId) { - yield* clearExistingSession(request, sessionId); - } - return jsonRpcError(403, -32001, "No organization in session — log in via the web app first"); - }); - -const dispatchPost = (request: Request, token: VerifiedToken) => - Effect.gen(function* () { - const sessionId = request.headers.get("mcp-session-id"); - const authError = yield* authorizeMcpOrganization(request, token, sessionId); - if (authError) return authError; - const organizationId = token.organizationId!; - - if (sessionId) return yield* forwardToExistingSession(request, sessionId, true, token); - - const ns = env.MCP_SESSION; - const stub = ns.get(ns.newUniqueId()); - const propagation = yield* currentPropagationHeaders(request); - yield* Effect.promise(() => - stub.init( - { - organizationId, - userId: token.accountId, - elicitationMode: readElicitationMode(request), - }, - propagation, - ), - ).pipe( - Effect.withSpan("mcp.do.init", { - attributes: { "mcp.request.session_id_present": false }, - }), - ); - const propagated = withPropagationHeaders( - withVerifiedIdentityHeaders(request, token), - propagation, - ); - const raw = yield* Effect.promise( - () => stub.handleRequest(propagated) as Promise, - ).pipe( - Effect.withSpan("mcp.do.handle_request", { - attributes: { - "mcp.request.method": request.method, - "mcp.request.session_id_present": false, - }, - }), - ); - const annotated = yield* peekAndAnnotate(raw); - return HttpServerResponse.raw(withMcpResponseHeaders(annotated)); - }); - -const dispatchGet = (request: Request, token: VerifiedToken) => { - const sessionId = request.headers.get("mcp-session-id"); - if (!sessionId) - return Effect.succeed(jsonRpcError(400, -32000, "mcp-session-id header required for SSE")); - return Effect.gen(function* () { - const authError = yield* authorizeMcpOrganization(request, token, sessionId); - if (authError) return authError; - return yield* forwardToExistingSession(request, sessionId, false, token); - }); -}; - -const dispatchDelete = (request: Request, token: VerifiedToken) => { - const sessionId = request.headers.get("mcp-session-id"); - if (!sessionId) return Effect.succeed(HttpServerResponse.empty({ status: 204 })); - return Effect.gen(function* () { - const authError = yield* authorizeMcpOrganization(request, token, sessionId); - if (authError) return authError; - return yield* forwardToExistingSession(request, sessionId, true, token); - }); -}; - -// --------------------------------------------------------------------------- -// App -// --------------------------------------------------------------------------- - -type McpRoute = "mcp" | "oauth-protected-resource" | "oauth-authorization-server" | null; - -/** - * Returns the MCP route type for a pathname, or `null` if the path isn't owned - * by the MCP handler. - * - * Exported so the test worker can share the exact same predicate the middleware - * uses — we avoid duplicating the "is this an MCP path?" logic across entry - * points. - */ -export const classifyMcpPath = (pathname: string): McpRoute => { - if (pathname === MCP_PATH) return "mcp"; - if (pathname === PROTECTED_RESOURCE_METADATA_PATH) return "oauth-protected-resource"; - if (pathname === "/.well-known/oauth-authorization-server") return "oauth-authorization-server"; - return null; -}; - -/** - * Raw Effect-native MCP app. Exported so alternate entry points (e.g. the - * vitest-pool-workers test worker) can provide their own auth layers because - * hitting WorkOS JWKS / membership APIs is not practical in the isolate. - */ -export const mcpApp: Effect.Effect< - HttpServerResponse.HttpServerResponse, - never, - HttpServerRequest.HttpServerRequest | McpAuth | McpOrganizationAuth -> = Effect.gen(function* () { - const httpRequest = yield* HttpServerRequest.HttpServerRequest; - const request = httpRequest.source as Request; - const route = classifyMcpPath(new URL(request.url).pathname); - - if (request.method === "OPTIONS") return corsPreflight; - if (route === "oauth-protected-resource") return yield* protectedResourceMetadata; - if (route === "oauth-authorization-server") return yield* authorizationServerMetadata; - - const auth = yield* McpAuth; - const authResult = yield* auth.verifyBearer(request).pipe(Effect.result); - - if (Result.isFailure(authResult)) { - yield* annotateMcpRequest(request, { - token: null, - parseBody: false, - }); - return yield* authTemporarilyUnavailable(authResult.failure); - } - const authValue = authResult.success; - - // Annotate before dispatch so even 401s show up with what we know. Only - // POST bodies are JSON-RPC payloads worth parsing; GET (SSE) and DELETE - // don't carry one. - yield* annotateMcpRequest(request, { - token: isMcpAuthorized(authValue) ? authValue.token : null, - parseBody: request.method === "POST" && isMcpAuthorized(authValue), - }); - - if (isMcpUnauthorized(authValue)) { - return unauthorized(authValue, PROTECTED_RESOURCE_METADATA_URL); - } - const token = authValue.token; - const dispatchEffect = Match.value(request.method).pipe( - Match.when("POST", () => dispatchPost(request, token)), - Match.when("GET", () => dispatchGet(request, token)), - Match.when("DELETE", () => dispatchDelete(request, token)), - Match.option, - ); - if (Option.isSome(dispatchEffect)) { - return yield* dispatchEffect.value; - } - return jsonRpcError(405, -32001, "Method not allowed"); -}).pipe( - Effect.withSpan("mcp.request"), - Effect.catchCause((cause) => - Effect.sync(() => { - console.error("[mcp] request failed:", Cause.pretty(cause)); - captureCause(cause); - return jsonRpcError(500, -32603, "Internal server error"); - }), - ), -); - -const rawMcpFetch = HttpEffect.toWebHandler( - mcpApp.pipe( - Effect.provide( - Layer.mergeAll( - McpAuthLive.pipe( - Layer.provide(ApiKeyService.WorkOS.pipe(Layer.provide(CoreSharedServices))), - ), - McpOrganizationAuthLive, - TelemetryLive, - ), - ), - ), -); - -/** - * Fetch handler for /mcp + /.well-known/* paths. - * - * Returns `null` when the path doesn't match a known MCP route so the caller - * (`start.ts`'s mcpRequestMiddleware) can fall through to `next()` and let - * TanStack Start handle normal routing — e.g. an unknown `/.well-known/*` - * path that should 404 through the regular route tree. - */ -export const mcpFetch = async (request: Request): Promise => { - if (classifyMcpPath(new URL(request.url).pathname) === null) return null; - return rawMcpFetch(request); -}; diff --git a/apps/cloud/src/mcp/auth-provider.ts b/apps/cloud/src/mcp/auth-provider.ts new file mode 100644 index 000000000..1c38885f5 --- /dev/null +++ b/apps/cloud/src/mcp/auth-provider.ts @@ -0,0 +1,212 @@ +// --------------------------------------------------------------------------- +// Cloud McpAuthProvider adapter — the cloud analog of selfHostMcpAuthProviderLayer. +// +// Folds the entire cloud edge auth/authz surface (WorkOS JWT verify + API-key +// bearer + per-request org-liveness check + the two OAuth discovery docs) into +// ONE `McpAuthProvider` Layer behind the shared host-mcp envelope. +// +// `authenticate(request)` runs on EVERY /mcp request and resolves a typed +// AuthOutcome: +// - missing bearer -> Unauthorized (challenge: Bearer resource_metadata=…) +// - invalid token/api key -> Unauthorized (challenge: Bearer error="invalid_token" …) +// - transient JWKS infra -> Unavailable (caught here; envelope renders 503 -32001) +// - no org / revoked org -> Forbidden ("No organization in session …", -32001). +// Because authenticate reads the mcp-session-id header to do the live org +// check, the envelope's dispose-on-Forbidden-with-sessionId path reproduces +// the old inline clearExistingSession. +// - verified + org allowed -> Authenticated(principal) +// +// The rich `mcp.request.annotate` client-fingerprint span (cloud-specific, no +// envelope seam) is emitted from here so telemetry parity is preserved. +// +// The OAuth endpoints (/authorize, /token, /register) are NOT cloud's — they +// live at WorkOS/AuthKit (external); only the two discovery docs are mounted. +// --------------------------------------------------------------------------- + +import { Cause, Effect, Layer, Predicate, Result } from "effect"; + +import { + authenticated, + forbidden, + unauthorized, + unavailable, + McpAuthProvider, + type AuthOutcome, + type McpDiscoveryRoute, + type Principal, +} from "@executor-js/host-mcp"; + +import { ApiKeyService } from "../auth/api-keys"; +import { CoreSharedServices } from "../api/core-shared-services"; +import { + bearerChallengeFor, + PROTECTED_RESOURCE_METADATA_PATH, + PROTECTED_RESOURCE_METADATA_URL, + McpAuth, + McpAuthLive, + McpOrganizationAuth, + McpOrganizationAuthLive, + type McpAuthResult, + type VerifiedToken, +} from "./auth"; +import { annotateMcpRequest } from "./telemetry"; +import { + authorizationServerMetadataResponse, + protectedResourceMetadataResponse, +} from "./oauth-metadata"; + +const AUTHORIZATION_SERVER_METADATA_PATH = "/.well-known/oauth-authorization-server"; + +const NO_ORGANIZATION_MESSAGE = "No organization in session — log in via the web app first"; + +/** + * Enrich a cloud {@link VerifiedToken} (which carries only accountId + + * organizationId) into the full {@link Principal} the seam validates. The + * envelope only uses `accountId` + `organizationId` for ownership; cloud + * resolves org name/email inside the DO, so the cosmetic identity fields carry + * empty placeholders. `organizationId` is guaranteed non-null here because the + * Forbidden branch already rejected the no-org case before Authenticated. + */ +const principalFromToken = (token: VerifiedToken, organizationId: string): Principal => ({ + accountId: token.accountId, + organizationId, + organizationName: "", + email: "", + name: null, + avatarUrl: null, + roles: [], +}); + +export const cloudMcpAuthProviderLayer: Layer.Layer< + McpAuthProvider, + never, + McpAuth | McpOrganizationAuth +> = Layer.effect( + McpAuthProvider, + Effect.gen(function* () { + const auth = yield* McpAuth; + const orgAuth = yield* McpOrganizationAuth; + + const discoveryRoutes: ReadonlyArray = [ + { + path: PROTECTED_RESOURCE_METADATA_PATH, + handler: () => Effect.succeed(protectedResourceMetadataResponse()), + }, + { + path: AUTHORIZATION_SERVER_METADATA_PATH, + handler: () => authorizationServerMetadataResponse, + }, + ]; + + const resourceMetadataUrl = (_request: Request): string => PROTECTED_RESOURCE_METADATA_URL; + + /** + * Resolve a verified bearer to a final AuthOutcome by running the live org + * check. Mirrors the old `authorizeMcpOrganization`: no org -> Forbidden; + * revoked live org -> Forbidden (the envelope disposes the session when a + * session-id is present). Telemetry-annotates before returning so even 401s + * and 403s carry the client fingerprint. + */ + const finishAuthorized = (request: Request, token: VerifiedToken): Effect.Effect => + Effect.gen(function* () { + // OLD `mcpApp` annotated with parseBody = (POST && isAuthorized) BEFORE + // org-authz, so a verified-but-no/revoked-org POST still captured + // mcp.rpc.method/id. The body is read via `request.clone().text()` + // (annotateMcpRequest -> readJsonRpcEnvelope), so it never consumes the + // original stream a downstream dispatch reads — safe on every path, + // including the Forbidden short-circuit. Keep parseBody keyed on POST, + // not on the org outcome, to preserve that telemetry. + const parseBody = request.method === "POST"; + + const organizationId = token.organizationId; + if (!organizationId) { + yield* annotateMcpRequest(request, { token, parseBody }); + return forbidden(NO_ORGANIZATION_MESSAGE, -32001); + } + + const allowed = yield* orgAuth.authorize(token.accountId, organizationId).pipe( + Effect.catchCause((error) => + Effect.gen(function* () { + yield* Effect.annotateCurrentSpan({ + "mcp.auth.organization_authorize_error": Cause.pretty(error), + }); + return false; + }), + ), + Effect.withSpan("mcp.auth.authorize_organization", { + attributes: { "mcp.auth.organization_id": organizationId }, + }), + ); + + yield* annotateMcpRequest(request, { token, parseBody }); + + if (!allowed) return forbidden(NO_ORGANIZATION_MESSAGE, -32001); + return authenticated(principalFromToken(token, organizationId)); + }); + + const toOutcome = (request: Request, result: McpAuthResult): Effect.Effect => { + if (Predicate.isTagged(result, "Authorized")) { + return finishAuthorized(request, result.token); + } + return annotateMcpRequest(request, { token: null, parseBody: false }).pipe( + Effect.as(unauthorized(bearerChallengeFor(result))), + ); + }; + + /** + * Never fails: a transient JWKS-infra failure (the McpJwtVerificationError + * the old `mcpApp` caught and turned into a 503) is caught HERE and mapped + * to Unavailable so the envelope renders the retryable 503 -32001. + */ + const authenticate = (request: Request): Effect.Effect => + auth.verifyBearer(request).pipe( + Effect.result, + Effect.flatMap((result) => + Result.isFailure(result) + ? annotateMcpRequest(request, { token: null, parseBody: false }).pipe( + Effect.flatMap(() => + Effect.annotateCurrentSpan({ + "mcp.auth.outcome": "system_error", + "mcp.auth.system_error.reason": result.failure.reason, + "mcp.auth.system_error.message": String(result.failure.cause).slice(0, 500), + }), + ), + Effect.as(unavailable("Authentication temporarily unavailable - please retry")), + ) + : toOutcome(request, result.success), + ), + Effect.withSpan("mcp.request"), + ); + + return { + discoveryRoutes, + resourceMetadataUrl, + authenticate, + }; + }), +); + +// --------------------------------------------------------------------------- +// The cloud MCP auth seam fed to `ExecutorApp.make`'s `mcp.auth` slot. +// +// `make`'s MCP seam contract is generic over the auth seam's residual +// (`Layer`). Cloud's MCP auth is a SEPARATE +// credential plane (WorkOS JWT + API-key bearer, no cookie session), so it does +// NOT read the neutral `IdentityProvider` fallback the way self-host does; it +// provides its own `McpAuth` + `McpOrganizationAuth` seams INTERNALLY (the +// production WorkOS JWT verify over `ApiKeyService.WorkOS` + live org-liveness), +// so `RMcpAuth = never` — no phantom requirement, no cast. (Self-host's seam +// genuinely requires `IdentityProvider`, so its `RMcpAuth = IdentityProvider`.) +// --------------------------------------------------------------------------- +export const cloudMcpAuth: Layer.Layer = cloudMcpAuthProviderLayer.pipe( + Layer.provide( + Layer.mergeAll( + McpAuthLive.pipe(Layer.provide(ApiKeyService.WorkOS.pipe(Layer.provide(CoreSharedServices)))), + McpOrganizationAuthLive, + ), + ), + // A boot-time WorkOS misconfiguration (the `WorkOSClient.Default` config error) + // is unrecoverable; die rather than leak it into the seam's channel. + // oxlint-disable-next-line executor/no-effect-escape-hatch -- boundary: a boot-time WorkOS misconfiguration is unrecoverable + Layer.orDie, +); diff --git a/apps/cloud/src/mcp/auth.ts b/apps/cloud/src/mcp/auth.ts new file mode 100644 index 000000000..c50d16191 --- /dev/null +++ b/apps/cloud/src/mcp/auth.ts @@ -0,0 +1,213 @@ +// --------------------------------------------------------------------------- +// Cloud MCP auth — the McpAuth / McpOrganizationAuth tags + their Live layers +// (the cloud McpAuthProvider resolves them; tests swap them), the API-key + +// JWT bearer dispatch, plus the typed auth-result discriminant the provider +// folds into the envelope's AuthOutcome. +// +// The JWT verify/classify lives in the `cloudflare:workers`-free `./jwt` leaf +// (the node-pool test imports it directly); this module reads `cloudflare: +// workers` env and depends on `./jwt`, never the other way around. +// --------------------------------------------------------------------------- + +import { env } from "cloudflare:workers"; +import { Context, Effect, Layer, Predicate } from "effect"; + +import { createCachedRemoteJWKSet } from "../jwks-cache"; +import { ApiKeyService } from "../auth/api-keys"; +import { BEARER_PREFIX } from "../auth/bearer"; +import { authorizeOrganization } from "../auth/organization"; +import { UserStoreService } from "../auth/context"; +import { CoreSharedServices } from "../api/core-shared-services"; +import { DbService } from "../services/db"; +import { bearerChallenge } from "./responses"; +import { McpJwtVerificationError, verifyWorkOSMcpAccessToken, type VerifiedToken } from "./jwt"; + +export { + McpJwtVerificationError, + verifyMcpAccessToken, + verifyWorkOSMcpAccessToken, + type VerifiedToken, +} from "./jwt"; + +// --------------------------------------------------------------------------- +// Constants +// --------------------------------------------------------------------------- + +export const AUTHKIT_DOMAIN = env.MCP_AUTHKIT_DOMAIN ?? "https://signin.executor.sh"; +export const RESOURCE_ORIGIN = env.MCP_RESOURCE_ORIGIN ?? "https://executor.sh"; +const WORKOS_CLIENT_ID = env.WORKOS_CLIENT_ID; + +// Module-scope cache survives across MCP requests within the same worker +// isolate. AuthKit's JWKS rotates on the order of hours/days, so a 1h TTL +// dominates the upstream cooldown without sacrificing rotation safety — +// `createCachedRemoteJWKSet` force-refreshes on key-not-found inside its +// resolver. Production telemetry showed ~222 fetches/8h with p99 1.7s on +// the previous default-cooldown setup; this collapses that to ~1 per +// isolate-hour. +const jwks = createCachedRemoteJWKSet(new URL(`${AUTHKIT_DOMAIN}/oauth2/jwks`)); + +const MCP_PATH = "/mcp"; +export const PROTECTED_RESOURCE_METADATA_PATH = "/.well-known/oauth-protected-resource/mcp"; +export const PROTECTED_RESOURCE_METADATA_URL = `${RESOURCE_ORIGIN}${PROTECTED_RESOURCE_METADATA_PATH}`; +export const RESOURCE_URL = `${RESOURCE_ORIGIN}${MCP_PATH}`; + +type McpUnauthorizedReason = "missing_bearer" | "invalid_token"; + +type McpAuthorizedResult = { + readonly _tag: "Authorized"; + readonly token: VerifiedToken; +}; + +type McpUnauthorizedResult = { + readonly _tag: "Unauthorized"; + readonly reason: McpUnauthorizedReason; + readonly description?: string; +}; + +export type McpAuthResult = McpAuthorizedResult | McpUnauthorizedResult; + +export const mcpAuthorized = (token: VerifiedToken): McpAuthorizedResult => ({ + _tag: "Authorized", + token, +}); + +export const mcpUnauthorized = ( + reason: McpUnauthorizedReason, + description?: string, +): McpUnauthorizedResult => ({ + _tag: "Unauthorized", + reason, + description, +}); + +/** Reason-sensitive RFC 9728 challenge for an Unauthorized auth result. */ +export const bearerChallengeFor = (result: McpUnauthorizedResult): string => + bearerChallenge( + { reason: result.reason, description: result.description }, + PROTECTED_RESOURCE_METADATA_URL, + ); + +// --------------------------------------------------------------------------- +// Auth tags + Live layers +// --------------------------------------------------------------------------- + +export class McpAuth extends Context.Service< + McpAuth, + { + readonly verifyBearer: ( + request: Request, + ) => Effect.Effect; + } +>()("@executor-js/cloud/McpAuth") {} + +export class McpOrganizationAuth extends Context.Service< + McpOrganizationAuth, + { + readonly authorize: ( + accountId: string, + organizationId: string, + ) => Effect.Effect; + } +>()("@executor-js/cloud/McpOrganizationAuth") {} + +const verifyJwt = (token: string) => + verifyWorkOSMcpAccessToken(token, jwks, { + issuer: AUTHKIT_DOMAIN, + audience: WORKOS_CLIENT_ID, + }); + +const DbLive = DbService.Live; +const UserStoreLive = UserStoreService.Live.pipe(Layer.provide(DbLive)); +const McpOrganizationAuthServices = Layer.mergeAll(DbLive, UserStoreLive, CoreSharedServices); + +export const McpOrganizationAuthLive = Layer.succeed(McpOrganizationAuth)({ + authorize: (accountId, organizationId) => + authorizeOrganization(accountId, organizationId).pipe( + Effect.map((org) => org !== null), + Effect.provide(McpOrganizationAuthServices), + ), +}); + +const looksLikeJwt = (token: string): boolean => token.split(".").length === 3; + +export const McpAuthLive = Layer.effect( + McpAuth, + Effect.gen(function* () { + const apiKeys = yield* ApiKeyService; + + const verifyApiKey = Effect.fn("mcp.auth.verify_api_key")(function* (token: string) { + const principal = yield* apiKeys.validate(token).pipe( + Effect.catchTag("ApiKeyValidationError", (error) => + Effect.fail( + new McpJwtVerificationError({ + cause: error.cause, + reason: "system", + }), + ), + ), + ); + if (!principal) { + yield* Effect.annotateCurrentSpan({ + "mcp.auth.outcome": "invalid", + "mcp.auth.invalid_reason": "api_key", + }); + return mcpUnauthorized("invalid_token", "The API key is invalid"); + } + + yield* Effect.annotateCurrentSpan({ + "mcp.auth.outcome": "verified", + "mcp.auth.credential_type": "api_key", + "mcp.auth.has_organization": true, + }); + return mcpAuthorized({ + accountId: principal.accountId, + organizationId: principal.organizationId, + }); + }); + + const verifyJwtBearer = Effect.fn("mcp.auth.verify_jwt_bearer")(function* (token: string) { + const verified = yield* verifyJwt(token).pipe( + Effect.catchTag("McpJwtVerificationError", (error) => { + if (error.reason === "system") return Effect.fail(error); + return Effect.gen(function* () { + yield* Effect.annotateCurrentSpan({ + "mcp.auth.outcome": "invalid", + "mcp.auth.invalid_reason": error.reason, + }); + return mcpUnauthorized( + "invalid_token", + error.reason === "expired" + ? "The access token expired" + : "The access token is invalid", + ); + }); + }), + ); + if (!verified) return mcpUnauthorized("invalid_token", "The access token is invalid"); + if (Predicate.isTagged(verified, "Unauthorized")) return verified; + if (!verified.accountId) { + yield* Effect.annotateCurrentSpan({ "mcp.auth.outcome": "missing_subject" }); + return mcpUnauthorized("invalid_token", "The access token is invalid"); + } + yield* Effect.annotateCurrentSpan({ + "mcp.auth.outcome": "verified", + "mcp.auth.credential_type": "jwt", + "mcp.auth.has_organization": !!verified.organizationId, + }); + return mcpAuthorized(verified); + }); + + return { + verifyBearer: Effect.fn("mcp.auth.verify_bearer")(function* (request) { + const authHeader = request.headers.get("authorization"); + if (!authHeader?.startsWith(BEARER_PREFIX)) { + yield* Effect.annotateCurrentSpan({ "mcp.auth.outcome": "missing_bearer" }); + return mcpUnauthorized("missing_bearer"); + } + const token = authHeader.slice(BEARER_PREFIX.length).trim(); + if (!token) return mcpUnauthorized("invalid_token", "The bearer token is invalid"); + return yield* looksLikeJwt(token) ? verifyJwtBearer(token) : verifyApiKey(token); + }), + }; + }), +); diff --git a/apps/cloud/src/mcp/do-headers.ts b/apps/cloud/src/mcp/do-headers.ts new file mode 100644 index 000000000..5e051829c --- /dev/null +++ b/apps/cloud/src/mcp/do-headers.ts @@ -0,0 +1,110 @@ +// --------------------------------------------------------------------------- +// Worker <-> Durable-Object internal wire protocol headers + the trace/header +// plumbing the worker stamps before forwarding to the MCP session DO. +// +// The worker stamps the verified caller identity onto these headers before +// forwarding a request to the MCP session Durable Object; the DO reads them +// back to validate ownership against its stored session meta. Single-sourced +// here so the producer (worker, see withVerifiedIdentityHeaders) and the +// consumer (the DO, in session-durable-object.ts) cannot drift. +// +// This module stays react-start-free (it only uses `effect` + Web APIs) so the +// DO worker bundle that reaches it can be bundled by wrangler/esbuild. +// --------------------------------------------------------------------------- + +import { Effect } from "effect"; + +export const INTERNAL_ACCOUNT_ID_HEADER = "x-executor-mcp-account-id"; +export const INTERNAL_ORGANIZATION_ID_HEADER = "x-executor-mcp-organization-id"; + +const TRUE_QUERY_VALUES = new Set(["1", "true", "yes", "on"]); + +/** The verified identity used to stamp the DO's internal owner headers. */ +export type VerifiedTokenHeaders = { + readonly accountId: string; + readonly organizationId: string; +}; + +// Worker and DO run in separate isolates with independent WebSdk tracer +// providers. Neither one can see the other's OTEL context, so the DO used +// to emit a brand-new root trace on every stub call. Ferry the worker span +// context across with W3C headers: `traceparent` generated from the active +// Effect span plus passthrough `tracestate` / `baggage` from the inbound +// request. +type IncomingPropagationHeaders = { + readonly traceparent?: string; + readonly tracestate?: string; + readonly baggage?: string; +}; + +const currentTraceparent = Effect.map(Effect.currentSpan, (span) => { + if (!span || !span.traceId || !span.spanId) return undefined; + const flags = span.sampled ? "01" : "00"; + return `00-${span.traceId}-${span.spanId}-${flags}`; +}).pipe(Effect.orElseSucceed(() => undefined)); + +export const currentPropagationHeaders = ( + request: Request, +): Effect.Effect => + Effect.map(currentTraceparent, (traceparent) => ({ + traceparent, + tracestate: request.headers.get("tracestate") ?? undefined, + baggage: request.headers.get("baggage") ?? undefined, + })); + +export const withPropagationHeaders = ( + request: Request, + propagation: IncomingPropagationHeaders, +): Request => { + const headers = new Headers(request.headers); + if (propagation.traceparent) { + headers.set("traceparent", propagation.traceparent); + } + if (propagation.tracestate) { + headers.set("tracestate", propagation.tracestate); + } + if (propagation.baggage) { + headers.set("baggage", propagation.baggage); + } + return new Request(request, { headers }); +}; + +export const withVerifiedIdentityHeaders = ( + request: Request, + token: VerifiedTokenHeaders, +): Request => { + const headers = new Headers(request.headers); + headers.set(INTERNAL_ACCOUNT_ID_HEADER, token.accountId); + headers.set(INTERNAL_ORGANIZATION_ID_HEADER, token.organizationId ?? ""); + return new Request(request, { headers }); +}; + +export const withMcpResponseHeaders = (response: Response): Response => { + const headers = new Headers(response.headers); + headers.set("access-control-allow-origin", "*"); + headers.set("access-control-expose-headers", "mcp-session-id"); + return new Response(response.body, { + status: response.status, + statusText: response.statusText, + headers, + }); +}; + +type McpElicitationMode = "browser" | "model" | "native"; + +const MCP_ELICITATION_MODES = new Set(["browser", "model", "native"]); + +export const readElicitationMode = (request: Request): McpElicitationMode => { + const url = new URL(request.url); + const mode = url.searchParams.get("elicitation_mode"); + if (mode && MCP_ELICITATION_MODES.has(mode as McpElicitationMode)) { + return mode as McpElicitationMode; + } + + const legacyModelResume = url.searchParams.get("allow_model_resume"); + if (legacyModelResume !== null && TRUE_QUERY_VALUES.has(legacyModelResume.toLowerCase())) { + return "model"; + } + + return "model"; +}; diff --git a/apps/cloud/src/mcp/index.ts b/apps/cloud/src/mcp/index.ts new file mode 100644 index 000000000..051083bab --- /dev/null +++ b/apps/cloud/src/mcp/index.ts @@ -0,0 +1,25 @@ +// --------------------------------------------------------------------------- +// Cloud MCP — the three provider seams behind the shared host-mcp envelope, +// named to match the app composition root's `mcp: { auth, sessions, reporter }`: +// +// - auth -> cloudMcpAuth (WorkOS JWT + API-key + org-liveness + the +// two OAuth discovery docs) +// - sessions -> cloudMcpSessions (the Durable-Object session dispatch) +// - reporter -> cloudMcpReporter (forwards request-orchestration defects to +// Sentry + the dev console) +// +// These three are what `app.ts`'s `ExecutorApp.make` slots into its `mcp` +// providers; the unified app handler serves /mcp from the app layer (like +// self-host), so start.ts no longer hand-mounts MCP. The MCP-path predicate + +// test-worker envelope builder live in `./mount` (`classifyMcpPath` / +// `makeMcpWebHandler`), imported directly there. The MCP session Durable Object +// class itself stays a platform-side export (server.ts) and imports its +// siblings directly, NOT this barrel, to keep the DO bundle react-start-free. +// --------------------------------------------------------------------------- + +// `cloudMcpAuth` is the packaged seam (the WorkOS JWT/api-key auth provider with +// its `McpAuth`/`McpOrganizationAuth` seams provided internally), shaped as the +// `Layer` `ExecutorApp.make` expects. +export { cloudMcpAuth } from "./auth-provider"; +export { cloudMcpSessionStoreLayer as cloudMcpSessions } from "./session-store"; +export { cloudMcpReporter } from "./reporter"; diff --git a/apps/cloud/src/mcp-auth.ts b/apps/cloud/src/mcp/jwt.ts similarity index 86% rename from apps/cloud/src/mcp-auth.ts rename to apps/cloud/src/mcp/jwt.ts index ef691c11e..c7331085e 100644 --- a/apps/cloud/src/mcp-auth.ts +++ b/apps/cloud/src/mcp/jwt.ts @@ -1,3 +1,13 @@ +// --------------------------------------------------------------------------- +// MCP bearer JWT verify/classify (formerly mcp-auth.ts). +// +// Kept as its own `cloudflare:workers`-free leaf: the node-pool test +// (mcp-auth.node.test.ts) imports these verifiers at runtime, and +// `test-bearer.ts` (shared with node tests) imports `VerifiedToken` from here. +// `mcp/auth.ts` (which DOES read `cloudflare:workers` env) imports this leaf; +// the dependency points one way only. +// --------------------------------------------------------------------------- + import { Data, Effect, Result, Schema } from "effect"; import { jwtVerify, type JWTVerifyGetKey } from "jose"; import { JWKSInvalid, JWKSTimeout, JWTExpired } from "jose/errors"; diff --git a/apps/cloud/src/mcp/mount.ts b/apps/cloud/src/mcp/mount.ts new file mode 100644 index 000000000..09d3bc61b --- /dev/null +++ b/apps/cloud/src/mcp/mount.ts @@ -0,0 +1,101 @@ +// --------------------------------------------------------------------------- +// Cloud MCP front — test-worker helpers for the shared, provider-neutral +// host-mcp serving envelope (@executor-js/host-mcp) behind cloud's two seams. +// --------------------------------------------------------------------------- +// +// PRODUCTION serves /mcp through `app.ts`'s unified `ExecutorApp.make` handler +// (the same `McpServingRoutes` envelope provided `cloudMcpAuth` + +// `cloudMcpSessions`), dispatched by start.ts alongside /api. This module is the +// TEST-WORKER counterpart: it exposes the two pieces `test-worker.ts` needs to +// build the identical envelope with swapped auth seams — +// - `makeMcpWebHandler` — bind `McpServingRoutes` to a web handler over a +// given auth provider + seam requirements + telemetry runtime, mirroring the +// self-host mount (`HttpRouter.toWebHandler`). +// - `classifyMcpPath` — the "is this an MCP path?" predicate (`/mcp` + the +// two discovery docs) that start.ts's dispatch and the test worker share. +// +// Cloud's two envelope seams: +// - McpAuthProvider -> cloudMcpAuthProviderLayer (WorkOS JWT + API key + +// per-request org-liveness + the two OAuth discovery docs) +// - McpSessionStore -> cloudMcpSessionStoreLayer (Durable-Object dispatch) +// +// Streaming passthrough — the DO returns a `Response` whose body is a +// `ReadableStream` (SSE). The envelope wraps it with `HttpServerResponse.raw`, +// which passes the `Response` body through unchanged. +// --------------------------------------------------------------------------- + +import { HttpRouter, HttpServer } from "effect/unstable/http"; +import { Layer } from "effect"; + +import { McpServingRoutes } from "@executor-js/host-mcp"; + +import { McpAuth, McpOrganizationAuth, PROTECTED_RESOURCE_METADATA_PATH } from "./auth"; +import { cloudMcpReporter } from "./reporter"; +import { cloudMcpSessionStoreLayer } from "./session-store"; + +const MCP_PATH = "/mcp"; + +type McpRoute = "mcp" | "oauth-protected-resource" | "oauth-authorization-server" | null; + +/** + * Returns the MCP route type for a pathname, or `null` if the path isn't owned + * by the MCP handler. + * + * Exported so the test worker and start.ts's middleware share the exact same + * "is this an MCP path?" predicate — under the envelope `HttpRouter.toWebHandler` + * 404s unknown paths rather than returning `null`, so this gate decides whether + * to even invoke the envelope handler (null -> fall through to Start routing). + * The known-path set stays in sync with the envelope's mounted routes: + * `/mcp` + the two provider-declared discovery paths. + */ +export const classifyMcpPath = (pathname: string): McpRoute => { + if (pathname === MCP_PATH) return "mcp"; + if (pathname === PROTECTED_RESOURCE_METADATA_PATH) return "oauth-protected-resource"; + if (pathname === "/.well-known/oauth-authorization-server") return "oauth-authorization-server"; + return null; +}; + +/** + * Build the envelope web handler from the shared `McpServingRoutes` Layer, + * provided cloud's two seams. Mirrors the self-host mount (apps/host-selfhost + * api.ts): `HttpRouter.provideRequest` clears the route handlers' per-request + * seam requirements, the build-time `Layer.provide(McpAuthProviderLive)` + * satisfies the `HttpRouter.use` callback's read of `discoveryRoutes`, and + * `HttpServer.layerServices` supplies the platform services for the web + * handler binding. + * + * `seamsRequirements` resolves the McpAuth + McpOrganizationAuth tags the + * provider reads; `runtime` (the WebSdk telemetry layer) is provided to the + * WHOLE router so every route-handler span lands on cloud's tracer — the same + * tracer the old `mcpApp` was provided. + * + * Exported so the test worker can build the same handler with test seam Layers. + */ +export const makeMcpWebHandler = (options: { + readonly authProvider: Layer.Layer< + import("@executor-js/host-mcp").McpAuthProvider, + never, + McpAuth | McpOrganizationAuth + >; + readonly seamsRequirements: Layer.Layer; + readonly runtime: Layer.Layer; +}): ((request: Request) => Promise) => { + const McpAuthProviderLive = options.authProvider.pipe(Layer.provide(options.seamsRequirements)); + const McpSeams = Layer.mergeAll(McpAuthProviderLive, cloudMcpSessionStoreLayer, cloudMcpReporter); + const McpRouteLive = McpServingRoutes.pipe( + HttpRouter.provideRequest(McpSeams), + Layer.provide(McpAuthProviderLive), + ); + return HttpRouter.toWebHandler( + McpRouteLive.pipe( + Layer.provideMerge(Layer.mergeAll(options.runtime, HttpServer.layerServices)), + ), + ).handler; +}; + +// Production no longer mounts /mcp here — `app.ts`'s unified `ExecutorApp.make` +// handler serves it (the same `McpServingRoutes` envelope + cloud seams as +// `cloudMcpAuth`/`cloudMcpSessions`), dispatched by start.ts alongside /api. +// `classifyMcpPath` + `makeMcpWebHandler` remain because the workerd/miniflare +// test worker (`test-worker.ts`) builds the same envelope with swapped auth +// seams and classifies MCP paths with the identical predicate. diff --git a/apps/cloud/src/mcp/oauth-metadata.ts b/apps/cloud/src/mcp/oauth-metadata.ts new file mode 100644 index 000000000..db69f59f0 --- /dev/null +++ b/apps/cloud/src/mcp/oauth-metadata.ts @@ -0,0 +1,32 @@ +// --------------------------------------------------------------------------- +// OAuth metadata endpoints — returned as web `Response`s for the envelope's +// discovery routes. +// --------------------------------------------------------------------------- + +import { Effect } from "effect"; + +import { AUTHKIT_DOMAIN, RESOURCE_URL } from "./auth"; +import { CORS_ALLOW_ORIGIN } from "./responses"; + +const jsonWebResponse = (body: unknown, status = 200): Response => + new Response(JSON.stringify(body), { + status, + headers: { "content-type": "application/json", ...CORS_ALLOW_ORIGIN }, + }); + +export const protectedResourceMetadataResponse = (): Response => + jsonWebResponse({ + resource: RESOURCE_URL, + authorization_servers: [AUTHKIT_DOMAIN], + bearer_methods_supported: ["header"], + scopes_supported: [], + }); + +export const authorizationServerMetadataResponse: Effect.Effect = Effect.tryPromise({ + try: async () => { + const res = await fetch(`${AUTHKIT_DOMAIN}/.well-known/oauth-authorization-server`); + if (!res.ok) return jsonWebResponse({ error: "upstream_error" }, 502); + return jsonWebResponse(await res.json()); + }, + catch: () => undefined, +}).pipe(Effect.catchCause(() => Effect.succeed(jsonWebResponse({ error: "upstream_error" }, 502)))); diff --git a/apps/cloud/src/mcp/reporter.ts b/apps/cloud/src/mcp/reporter.ts new file mode 100644 index 000000000..73d5aeca7 --- /dev/null +++ b/apps/cloud/src/mcp/reporter.ts @@ -0,0 +1,24 @@ +// --------------------------------------------------------------------------- +// Cloud MCP error reporter seam — `cloudMcpReporter`. +// +// Forwards a request-orchestration defect the shared host-mcp envelope is about +// to render as a JSON-RPC 500 to Sentry (`captureCause`) and the dev console, +// preserving the OLD `mcpApp`'s top-level +// `console.error('[mcp] request failed', …)` + `captureCause` behavior that the +// shared envelope would otherwise swallow (it returns a `Response`). +// --------------------------------------------------------------------------- + +import { Cause, Effect, Layer } from "effect"; + +import { McpErrorReporter } from "@executor-js/host-mcp"; + +import { captureCause } from "../observability"; + +export const cloudMcpReporter: Layer.Layer = Layer.succeed(McpErrorReporter)({ + report: (cause) => + Effect.sync(() => { + // oxlint-disable-next-line no-console -- boundary: preserve the old mcpApp top-level request-failure log + console.error("[mcp] request failed:", Cause.pretty(cause)); + captureCause(cause); + }), +}); diff --git a/apps/cloud/src/mcp/responses.ts b/apps/cloud/src/mcp/responses.ts index d713cf765..8be019e30 100644 --- a/apps/cloud/src/mcp/responses.ts +++ b/apps/cloud/src/mcp/responses.ts @@ -1,7 +1,6 @@ import { HttpServerResponse } from "effect/unstable/http"; -import { Effect } from "effect"; -import type { McpJwtVerificationError } from "../mcp-auth"; +import { jsonRpcErrorBody } from "@executor-js/host-mcp"; export const CORS_ALLOW_ORIGIN = { "access-control-allow-origin": "*" } as const; @@ -13,7 +12,7 @@ type UnauthorizedAuth = { const quoteAuthParam = (value: string) => `"${value.replaceAll("\\", "\\\\").replaceAll('"', '\\"')}"`; -const bearerChallenge = (auth: UnauthorizedAuth, protectedResourceMetadataUrl: string) => { +export const bearerChallenge = (auth: UnauthorizedAuth, protectedResourceMetadataUrl: string) => { const params = auth.reason === "missing_bearer" ? [`resource_metadata=${quoteAuthParam(protectedResourceMetadataUrl)}`] @@ -28,20 +27,14 @@ const bearerChallenge = (auth: UnauthorizedAuth, protectedResourceMetadataUrl: s return `Bearer ${params.join(", ")}`; }; -export const jsonResponse = (body: unknown, status = 200) => - HttpServerResponse.jsonUnsafe(body, { status, headers: CORS_ALLOW_ORIGIN }); - -export const jsonRpcError = (status: number, code: number, message: string) => - HttpServerResponse.jsonUnsafe( - { jsonrpc: "2.0", error: { code, message }, id: null }, - { status, headers: CORS_ALLOW_ORIGIN }, - ); - +/** + * The cloud edge's JSON-RPC error `Response` (CORS-on — it crosses the browser + * boundary). Delegates to the canonical `jsonRpcErrorBody` renderer; the body + * is `{jsonrpc:"2.0",error:{code,message},id:null}` with `content-type` + + * `access-control-allow-origin: *`, byte-identical to the prior local copy. + */ export const jsonRpcWebResponse = (status: number, code: number, message: string) => - new Response(JSON.stringify({ jsonrpc: "2.0", error: { code, message }, id: null }), { - status, - headers: { ...CORS_ALLOW_ORIGIN, "content-type": "application/json" }, - }); + jsonRpcErrorBody(status, code, message); export const unauthorized = (auth: UnauthorizedAuth, protectedResourceMetadataUrl: string) => HttpServerResponse.jsonUnsafe( @@ -54,13 +47,3 @@ export const unauthorized = (auth: UnauthorizedAuth, protectedResourceMetadataUr }, }, ); - -export const authTemporarilyUnavailable = (error: McpJwtVerificationError) => - Effect.gen(function* () { - yield* Effect.annotateCurrentSpan({ - "mcp.auth.outcome": "system_error", - "mcp.auth.system_error.reason": error.reason, - "mcp.auth.system_error.message": String(error.cause).slice(0, 500), - }); - return jsonRpcError(503, -32001, "Authentication temporarily unavailable - please retry"); - }); diff --git a/apps/cloud/src/mcp-session.ts b/apps/cloud/src/mcp/session-durable-object.ts similarity index 95% rename from apps/cloud/src/mcp-session.ts rename to apps/cloud/src/mcp/session-durable-object.ts index 25a55c635..e4d09e973 100644 --- a/apps/cloud/src/mcp-session.ts +++ b/apps/cloud/src/mcp/session-durable-object.ts @@ -12,28 +12,30 @@ import type { TransportState } from "agents/mcp"; import { drizzle } from "drizzle-orm/postgres-js"; import postgres, { type Sql } from "postgres"; -import { createExecutorMcpServer } from "@executor-js/host-mcp"; +import { jsonRpcErrorBody } from "@executor-js/host-mcp"; +import { createExecutorMcpServer } from "@executor-js/host-mcp/tool-server"; import { buildExecuteDescription, formatPausedExecution, type ExecutionEngine, type ResumeResponse, } from "@executor-js/execution"; -import type { DrizzleDb, DbServiceShape } from "./services/db"; - -// Import directly from core-shared-services, NOT from ./api/layers.ts. -// The full layers module pulls in `auth/handlers.ts` → `@tanstack/react-start/server`, -// which uses a `#tanstack-start-entry` subpath specifier that breaks module -// load under vitest-pool-workers. The DO only needs the core two services -// (WorkOSAuth + AutumnService), so we import them from the tight module. -import { CoreSharedServices } from "./api/core-shared-services"; -import { UserStoreService } from "./auth/context"; -import { resolveOrganization } from "./auth/resolve-organization"; -import { DbService, combinedSchema, resolveConnectionString } from "./services/db"; -import { makeExecutionStack } from "./services/execution-stack"; -import { makeMcpWorkerTransport, type McpWorkerTransport } from "./services/mcp-worker-transport"; -import { DoTelemetryLive } from "./services/telemetry"; -import { captureCause } from "./observability"; +import type { DrizzleDb, DbServiceShape } from "../services/db"; + +// The DO only needs the neutral boot-scoped service (WorkOSClient). It never +// bills, so it does NOT depend on any billing service — `CloudExecutionStackLayer` +// here is the no-op-decorator (Autumn-free) stack. Imported from the isolated +// leaf (not `../api/layers`) so the DO bundle stays free of `auth/handlers.ts` → +// `@tanstack/react-start/server`; see `../api/core-shared-services.ts`. +import { CoreSharedServices } from "../api/core-shared-services"; +import { UserStoreService } from "../auth/context"; +import { resolveOrganization } from "../auth/organization"; +import { DbService, combinedSchema, resolveConnectionString } from "../services/db"; +import { CloudExecutionStackLayer, makeExecutionStack } from "../services/execution-stack"; +import { makeMcpWorkerTransport, type McpWorkerTransport } from "../services/mcp-worker-transport"; +import { DoTelemetryLive } from "../services/telemetry"; +import { captureCause } from "../observability"; +import { INTERNAL_ACCOUNT_ID_HEADER, INTERNAL_ORGANIZATION_ID_HEADER } from "./do-headers"; // --------------------------------------------------------------------------- // Types @@ -52,7 +54,7 @@ export type IncomingTraceHeaders = { readonly baggage?: string; }; -export type McpSessionApprovalIdentity = { +export type McpApprovalOwner = { readonly accountId: string; readonly organizationId: string; }; @@ -111,8 +113,6 @@ const TRANSPORT_STATE_KEY = "transport"; const SESSION_META_KEY = "session-meta"; const LAST_ACTIVITY_KEY = "last-activity-ms"; const approvalResponseKey = (executionId: string) => `approval-response:${executionId}`; -const INTERNAL_ACCOUNT_ID_HEADER = "x-executor-mcp-account-id"; -const INTERNAL_ORGANIZATION_ID_HEADER = "x-executor-mcp-organization-id"; // --------------------------------------------------------------------------- // Errors @@ -126,11 +126,12 @@ class OrganizationNotFoundError extends Data.TaggedError("OrganizationNotFoundEr // Helpers // --------------------------------------------------------------------------- +// The DO's JSON-RPC error bodies are INNER responses (no CORS): the edge worker +// re-wraps them with CORS before they leave the origin, so the canonical +// renderer is called with `cors: false` to stay byte-identical to the prior +// hand-rolled copy (`content-type: application/json` only). const jsonRpcError = (status: number, code: number, message: string) => - new Response(JSON.stringify({ jsonrpc: "2.0", error: { code, message }, id: null }), { - status, - headers: { "content-type": "application/json" }, - }); + jsonRpcErrorBody(status, code, message, { cors: false }); const sessionOwnerMismatch = () => jsonRpcError(403, -32003, "MCP session does not belong to the current bearer"); @@ -357,6 +358,9 @@ export class McpSessionDO extends DurableObject { sessionMeta.userId, sessionMeta.organizationId, sessionMeta.organizationName, + ).pipe( + Effect.provide(CloudExecutionStackLayer), + Effect.withSpan("McpSessionDO.makeExecutionStack"), ); // Build the description here so the postgres query it runs // (`executor.sources.list`) lands as a child of @@ -472,7 +476,7 @@ export class McpSessionDO extends DurableObject { } private validateApprovalIdentity( - identity: McpSessionApprovalIdentity, + identity: McpApprovalOwner, ): Effect.Effect<"ok" | "not_found" | "forbidden"> { const self = this; return Effect.gen(function* () { @@ -716,7 +720,7 @@ export class McpSessionDO extends DurableObject { async getPausedExecutionForApproval( executionId: string, - identity: McpSessionApprovalIdentity, + identity: McpApprovalOwner, incoming?: IncomingTraceHeaders, ): Promise { const self = this; @@ -789,7 +793,7 @@ export class McpSessionDO extends DurableObject { async resumeExecutionForApproval( executionId: string, - identity: McpSessionApprovalIdentity, + identity: McpApprovalOwner, response: ResumeResponse, incoming?: IncomingTraceHeaders, ): Promise { diff --git a/apps/cloud/src/mcp/session-store.ts b/apps/cloud/src/mcp/session-store.ts new file mode 100644 index 000000000..4c4b6730e --- /dev/null +++ b/apps/cloud/src/mcp/session-store.ts @@ -0,0 +1,168 @@ +// --------------------------------------------------------------------------- +// Cloud McpSessionStore adapter — the Durable-Object-backed variant of the +// shared host-mcp session seam (cloud's analog of the self-host in-process +// store). +// +// `dispatch` owns the OUTER worker-isolate orchestration (the helpers it uses +// live in ./do-headers + ./response-peek): +// - choose the DO stub (newUniqueId for create vs idFromString for forward) +// - stub.init(...) on create, stub.handleRequest(...) on forward/create +// - identity-header injection (withVerifiedIdentityHeaders) + trace +// propagation (withPropagationHeaders + currentPropagationHeaders) +// - response post-processing (peekAndAnnotate, withMcpResponseHeaders) +// - elicitation-mode parsing (readElicitationMode) +// +// The DO CLASS internals (engine build + MCP server + transport inside the +// isolate, owner validation against stored meta, restore/suspend, alarm) stay +// UNCHANGED — the store is the DO's cross-isolate engine host. +// +// IMPORTANT: the store returns the DO `Response` VERBATIM for the two cloud +// error shapes so their exact bytes are preserved: +// - owner mismatch -> 403 -32003 "MCP session does not belong to the current bearer" +// - timed out -> 404 -32001 "Session timed out due to inactivity — please reconnect" +// Returning the DO Response (not the seam's "forbidden"/"not-found" +// discriminants) keeps the "does not belong" / "timed out" message assertions +// byte-for-byte. (The envelope's "forbidden" discriminant happens to render the +// identical 403 -32003 body, but "not-found" would emit a generic "Session not +// found" message, so for that path the DO Response is mandatory.) +// +// The envelope short-circuits a bare GET (400) and bare DELETE (204) BEFORE +// calling dispatch, so the store only ever sees create (POST, no session-id) or +// forward (any method, session-id present). +// --------------------------------------------------------------------------- + +import { env } from "cloudflare:workers"; +import { Effect, Layer } from "effect"; + +import { + McpSessionStore, + type McpDispatchInput, + type McpDispatchResult, +} from "@executor-js/host-mcp"; + +import { peekAndAnnotate } from "./response-peek"; +import { + currentPropagationHeaders, + readElicitationMode, + withMcpResponseHeaders, + withPropagationHeaders, + withVerifiedIdentityHeaders, + type VerifiedTokenHeaders, +} from "./do-headers"; + +/** + * Forward a request to an existing session DO. `peek` tees the body for + * telemetry on POST/DELETE; GET (SSE) streams through untouched. Returns the + * DO `Response` verbatim (incl. its 403 -32003 / 404 -32001 error bodies). + */ +const forwardToExistingSession = ( + request: Request, + sessionId: string, + peek: boolean, + token: VerifiedTokenHeaders, +): Effect.Effect => + Effect.gen(function* () { + const ns = env.MCP_SESSION; + const stub = ns.get(ns.idFromString(sessionId)); + const propagation = yield* currentPropagationHeaders(request); + const propagated = withPropagationHeaders( + withVerifiedIdentityHeaders(request, token), + propagation, + ); + const raw = yield* Effect.promise( + () => stub.handleRequest(propagated) as Promise, + ).pipe( + Effect.withSpan("mcp.do.handle_request", { + attributes: { + "mcp.request.method": request.method, + "mcp.request.session_id_present": true, + }, + }), + ); + const annotated = peek ? yield* peekAndAnnotate(raw) : raw; + return withMcpResponseHeaders(annotated); + }); + +/** Open a new session DO (POST, no session-id): init then handleRequest. */ +const createSession = (request: Request, token: VerifiedTokenHeaders): Effect.Effect => + Effect.gen(function* () { + const ns = env.MCP_SESSION; + const stub = ns.get(ns.newUniqueId()); + const propagation = yield* currentPropagationHeaders(request); + yield* Effect.promise(() => + stub.init( + { + organizationId: token.organizationId, + userId: token.accountId, + elicitationMode: readElicitationMode(request), + }, + propagation, + ), + ).pipe( + Effect.withSpan("mcp.do.init", { + attributes: { "mcp.request.session_id_present": false }, + }), + ); + const propagated = withPropagationHeaders( + withVerifiedIdentityHeaders(request, token), + propagation, + ); + const raw = yield* Effect.promise( + () => stub.handleRequest(propagated) as Promise, + ).pipe( + Effect.withSpan("mcp.do.handle_request", { + attributes: { + "mcp.request.method": request.method, + "mcp.request.session_id_present": false, + }, + }), + ); + const annotated = yield* peekAndAnnotate(raw); + return withMcpResponseHeaders(annotated); + }); + +const clearExistingSession = (sessionId: string, request?: Request): Effect.Effect => + Effect.gen(function* () { + const ns = env.MCP_SESSION; + const stub = ns.get(ns.idFromString(sessionId)); + // Disposal carries trace context from the active request span. When the + // envelope forwards the inbound request (the Forbidden-with-session + // teardown), use it so the request's W3C tracestate/baggage propagate onto + // the clearSession RPC (the OLD clearExistingSession(request, sessionId) + // behavior); otherwise fall back to a synthetic request (traceparent still + // links the span via the active Effect span). + const propagation = yield* currentPropagationHeaders( + request ?? new Request("https://mcp.invalid/mcp"), + ); + yield* Effect.promise(() => stub.clearSession(propagation) as Promise).pipe( + Effect.catchCause(() => Effect.void), + Effect.withSpan("mcp.do.clear_session", { + attributes: { "mcp.request.session_id_present": true }, + }), + ); + }); + +export const cloudMcpSessionStoreLayer: Layer.Layer = Layer.succeed( + McpSessionStore, +)({ + dispatch: ({ + request, + principal, + sessionId, + }: McpDispatchInput): Effect.Effect => { + // The principal carries the verified account + org used to stamp the DO's + // identity headers (the DO validates ownership against stored meta). + const token: VerifiedTokenHeaders = { + accountId: principal.accountId, + organizationId: principal.organizationId, + }; + // The enclosing `mcp.request` span is opened once per request by the cloud + // McpAuthProvider's `authenticate` (auth-provider.ts), which also carries + // the client-fingerprint attributes. The DO RPC child spans (`mcp.do.*`) + // attach to it directly, so dispatch must NOT open a second `mcp.request`. + return sessionId + ? forwardToExistingSession(request, sessionId, request.method !== "GET", token) + : createSession(request, token); + }, + dispose: (sessionId, request) => clearExistingSession(sessionId, request), +}); diff --git a/apps/cloud/src/mcp/telemetry.ts b/apps/cloud/src/mcp/telemetry.ts new file mode 100644 index 000000000..dc30b8f01 --- /dev/null +++ b/apps/cloud/src/mcp/telemetry.ts @@ -0,0 +1,221 @@ +// --------------------------------------------------------------------------- +// Client fingerprint capture +// --------------------------------------------------------------------------- +// Annotates the Effect span with everything we can learn about a connecting MCP client: the +// parsed JSON-RPC body, whitelisted request headers, CF request metadata, +// and verified-JWT claims. Lets us compare how each client (Claude Code, +// Claude.ai web, ChatGPT, custom scripts, ...) actually reports over the +// wire. Runs before dispatch so unauthorized requests still get fingerprinted. +// +// No envelope seam exists for this; the cloud McpAuthProvider invokes +// `annotateMcpRequest` inside its `authenticate` so telemetry parity holds. +// --------------------------------------------------------------------------- + +import { Effect, Match, Option, Schema } from "effect"; + +import { BEARER_PREFIX } from "../auth/bearer"; +import type { VerifiedToken } from "./auth"; + +type CfRequestMetadata = { + country?: string; + city?: string; + region?: string; + timezone?: string; + asn?: number; + asOrganization?: string; + tlsVersion?: string; + tlsCipher?: string; + httpProtocol?: string; + colo?: string; +}; + +const requestWithCf = (request: Request): Request & { cf?: CfRequestMetadata } => + request as Request & { cf?: CfRequestMetadata }; + +const getCfMeta = (request: Request): CfRequestMetadata => requestWithCf(request).cf ?? {}; + +const HEADERS_TO_DUMP = [ + "accept", + "accept-encoding", + "accept-language", + "cache-control", + "content-type", + "mcp-protocol-version", + "origin", + "referer", + "sec-fetch-dest", + "sec-fetch-mode", + "sec-fetch-site", + "user-agent", + "x-client-name", + "x-client-version", + "x-requested-with", +] as const; + +const dumpHeaders = (request: Request): Record => { + const out: Record = {}; + for (const name of HEADERS_TO_DUMP) { + const value = request.headers.get(name); + if (value !== null) out[`mcp.http.header.${name}`] = value; + } + const authHeader = request.headers.get("authorization"); + if (authHeader) { + out["mcp.http.header.authorization.scheme"] = authHeader.split(" ", 1)[0] ?? ""; + out["mcp.http.header.authorization.length"] = String(authHeader.length); + } + // Record the full header name list too — surfaces anything unexpected + // without us having to enumerate every possibility up front. + out["mcp.http.header.names"] = Array.from(request.headers.keys()).sort().join(","); + return out; +}; + +// JSON-RPC shapes — narrow to just the fields we fingerprint. Using Schema +// collapses the typeof-guard pile and surfaces "what does an MCP client +// actually send us" as declarative types. Unknown/malformed input decodes +// to None and contributes no span attrs. + +const UnknownRecord = Schema.Record(Schema.String, Schema.Unknown); + +const JsonRpcEnvelope = Schema.Struct({ + method: Schema.optional(Schema.String), + id: Schema.optional(Schema.Union([Schema.String, Schema.Number, Schema.Null])), + params: Schema.optional(UnknownRecord), + // Responses to server-initiated requests arrive as POST bodies too — + // notably elicitation replies (`result.action = "accept" | "decline" | "cancel"`). + result: Schema.optional(UnknownRecord), +}); +type JsonRpcEnvelope = typeof JsonRpcEnvelope.Type; + +const ElicitationReplyResult = Schema.Struct({ + action: Schema.optional(Schema.Literals(["accept", "decline", "cancel"])), +}); + +const InitializeParams = Schema.Struct({ + protocolVersion: Schema.optional(Schema.String), + clientInfo: Schema.optional( + Schema.Struct({ + name: Schema.optional(Schema.String), + version: Schema.optional(Schema.String), + title: Schema.optional(Schema.String), + }), + ), + capabilities: Schema.optional(UnknownRecord), +}); + +const NamedParams = Schema.Struct({ name: Schema.optional(Schema.String) }); +const UriParams = Schema.Struct({ uri: Schema.optional(Schema.String) }); + +const decodeJsonRpcEnvelopeString = Schema.decodeUnknownOption( + Schema.fromJsonString(JsonRpcEnvelope), +); +const decodeInitializeParams = Schema.decodeUnknownOption(InitializeParams); +const decodeNamedParams = Schema.decodeUnknownOption(NamedParams); +const decodeUriParams = Schema.decodeUnknownOption(UriParams); +const decodeElicitationReplyResult = Schema.decodeUnknownOption(ElicitationReplyResult); + +const readJsonRpcEnvelope = (request: Request): Effect.Effect> => + Effect.tryPromise({ + try: () => request.clone().text(), + catch: () => undefined, + }).pipe( + Effect.map((text) => (text ? decodeJsonRpcEnvelopeString(text) : Option.none())), + Effect.catchCause(() => Effect.succeed(Option.none())), + Effect.withSpan("mcp.request.read_json_rpc"), + ); + +const methodAttrs = (envelope: JsonRpcEnvelope): Record => { + const params = envelope.params ?? {}; + return Match.value(envelope.method).pipe( + Match.when("initialize", () => + Option.match(decodeInitializeParams(params), { + onNone: () => ({}) as Record, + onSome: (init) => ({ + ...(init.protocolVersion && { "mcp.client.protocol_version": init.protocolVersion }), + ...(init.clientInfo?.name && { "mcp.client.name": init.clientInfo.name }), + ...(init.clientInfo?.version && { "mcp.client.version": init.clientInfo.version }), + ...(init.clientInfo?.title && { "mcp.client.title": init.clientInfo.title }), + "mcp.client.capability.keys": Object.keys(init.capabilities ?? {}) + .sort() + .join(","), + }), + }), + ), + Match.when("tools/call", () => + Option.match(decodeNamedParams(params), { + onNone: () => ({}) as Record, + onSome: ({ name }) => (name ? { "mcp.tool.name": name } : {}), + }), + ), + Match.whenOr("resources/read", "resources/subscribe", () => + Option.match(decodeUriParams(params), { + onNone: () => ({}) as Record, + onSome: ({ uri }) => (uri ? { "mcp.resource.uri": uri } : {}), + }), + ), + Match.when("prompts/get", () => + Option.match(decodeNamedParams(params), { + onNone: () => ({}) as Record, + onSome: ({ name }) => (name ? { "mcp.prompt.name": name } : {}), + }), + ), + Match.option, + Option.getOrElse(() => ({}) as Record), + ); +}; + +const replyAttrs = (envelope: JsonRpcEnvelope): Record => { + if (!envelope.result || envelope.method) return {}; + return Option.match(decodeElicitationReplyResult(envelope.result), { + onNone: () => ({}), + onSome: ({ action }) => (action ? { "mcp.elicitation.action": action } : {}), + }); +}; + +const rpcAttrs = (envelope: Option.Option): Record => + Option.match(envelope, { + onNone: () => ({}), + onSome: (e) => ({ + ...(e.method && { "mcp.rpc.method": e.method }), + ...(e.id !== undefined && e.id !== null && { "mcp.rpc.id": String(e.id) }), + ...methodAttrs(e), + ...replyAttrs(e), + }), + }); + +export const annotateMcpRequest = ( + request: Request, + opts: { token: VerifiedToken | null; parseBody: boolean }, +): Effect.Effect => + Effect.gen(function* () { + const cf = getCfMeta(request); + const baseAttrs: Record = { + "mcp.request.method": request.method, + "mcp.request.session_id_present": !!request.headers.get("mcp-session-id"), + "mcp.request.session_id": request.headers.get("mcp-session-id") ?? "", + "mcp.auth.has_bearer": (request.headers.get("authorization") ?? "").startsWith(BEARER_PREFIX), + "mcp.auth.verified": !!opts.token, + "mcp.auth.organization_id": opts.token?.organizationId ?? "", + "mcp.auth.account_id": opts.token?.accountId ?? "", + "cf.country": cf.country ?? "", + "cf.city": cf.city ?? "", + "cf.region": cf.region ?? "", + "cf.timezone": cf.timezone ?? "", + "cf.asn": cf.asn ?? 0, + "cf.as_organization": cf.asOrganization ?? "", + "cf.tls_version": cf.tlsVersion ?? "", + "cf.tls_cipher": cf.tlsCipher ?? "", + "cf.http_protocol": cf.httpProtocol ?? "", + "cf.colo": cf.colo ?? "", + ...dumpHeaders(request), + }; + + const envelope = opts.parseBody ? yield* readJsonRpcEnvelope(request) : Option.none(); + const attrs = { + ...baseAttrs, + ...rpcAttrs(envelope), + "mcp.request.parse_body": opts.parseBody, + }; + + yield* Effect.annotateCurrentSpan(attrs); + yield* Effect.annotateCurrentSpan(attrs).pipe(Effect.withSpan("mcp.request.annotate")); + }); diff --git a/apps/cloud/src/org/api.ts b/apps/cloud/src/org/api.ts index c234bfefa..116e4f148 100644 --- a/apps/cloud/src/org/api.ts +++ b/apps/cloud/src/org/api.ts @@ -1,6 +1,14 @@ -import { HttpApiEndpoint, HttpApiGroup } from "effect/unstable/httpapi"; +import { HttpApi, HttpApiEndpoint, HttpApiGroup } from "effect/unstable/httpapi"; import { Schema } from "effect"; -import { UserStoreError, WorkOSError } from "../auth/errors"; +import { WorkOSError } from "../auth/errors"; +import { OrgAuth } from "../auth/middleware"; + +// --------------------------------------------------------------------------- +// Cloud-local org API — the WorkOS domain-verification surface only. Members / +// roles / invite / org-name moved to the shared provider-neutral `/account/*` +// surface (served by the WorkOS AccountProvider). Domains stay here because they +// have no provider-neutral equivalent and are cloud-only. +// --------------------------------------------------------------------------- export class Forbidden extends Schema.TaggedErrorClass()( "Forbidden", @@ -8,70 +16,10 @@ export class Forbidden extends Schema.TaggedErrorClass()( { httpApiStatus: 403 }, ) {} -const OrgMember = Schema.Struct({ - id: Schema.String, - userId: Schema.String, - email: Schema.String, - name: Schema.NullOr(Schema.String), - avatarUrl: Schema.NullOr(Schema.String), - role: Schema.String, - status: Schema.String, - lastActiveAt: Schema.NullOr(Schema.String), - isCurrentUser: Schema.Boolean, -}); - -const OrgMemberSeats = Schema.Struct({ - used: Schema.Number, - granted: Schema.Number, - unlimited: Schema.Boolean, -}); - -const OrgMembersResponse = Schema.Struct({ - members: Schema.Array(OrgMember), - seats: OrgMemberSeats, -}); - -const OrgRole = Schema.Struct({ - slug: Schema.String, - name: Schema.String, -}); - -const OrgRolesResponse = Schema.Struct({ - roles: Schema.Array(OrgRole), -}); - -const InviteBody = Schema.Struct({ - email: Schema.String, - roleSlug: Schema.optional(Schema.String), -}); - -const InviteResponse = Schema.Struct({ - id: Schema.String, - email: Schema.String, -}); - -const MembershipParams = { membershipId: Schema.String }; - const RemoveResponse = Schema.Struct({ success: Schema.Boolean, }); -const UpdateRoleBody = Schema.Struct({ - roleSlug: Schema.String, -}); - -const UpdateRoleResponse = Schema.Struct({ - success: Schema.Boolean, -}); - -const UpdateOrgNameBody = Schema.Struct({ - name: Schema.String, -}); - -const UpdateOrgNameResponse = Schema.Struct({ - name: Schema.String, -}); - const DomainItem = Schema.Struct({ id: Schema.String, domain: Schema.String, @@ -90,43 +38,7 @@ const DomainVerificationLinkResponse = Schema.Struct({ const DomainParams = { domainId: Schema.String }; -export { OrgMember, OrgMembersResponse }; - export class OrgApi extends HttpApiGroup.make("org") - .add( - HttpApiEndpoint.get("listMembers", "/org/members", { - success: OrgMembersResponse, - error: WorkOSError, - }), - ) - .add( - HttpApiEndpoint.get("listRoles", "/org/roles", { - success: OrgRolesResponse, - error: WorkOSError, - }), - ) - .add( - HttpApiEndpoint.post("invite", "/org/invite", { - payload: InviteBody, - success: InviteResponse, - error: [WorkOSError, Forbidden], - }), - ) - .add( - HttpApiEndpoint.delete("removeMember", "/org/members/:membershipId", { - params: MembershipParams, - success: RemoveResponse, - error: [WorkOSError, Forbidden], - }), - ) - .add( - HttpApiEndpoint.patch("updateMemberRole", "/org/members/:membershipId/role", { - params: MembershipParams, - payload: UpdateRoleBody, - success: UpdateRoleResponse, - error: [WorkOSError, Forbidden], - }), - ) .add( HttpApiEndpoint.get("listDomains", "/org/domains", { success: DomainsResponse, @@ -145,11 +57,7 @@ export class OrgApi extends HttpApiGroup.make("org") success: RemoveResponse, error: [WorkOSError, Forbidden], }), - ) - .add( - HttpApiEndpoint.patch("updateOrgName", "/org/name", { - payload: UpdateOrgNameBody, - success: UpdateOrgNameResponse, - error: [WorkOSError, UserStoreError, Forbidden], - }), ) {} + +/** Org API with org-level auth — requires authenticated session with an org. */ +export const OrgHttpApi = HttpApi.make("org").add(OrgApi).middleware(OrgAuth); diff --git a/apps/cloud/src/org/compose.ts b/apps/cloud/src/org/compose.ts deleted file mode 100644 index 25979da51..000000000 --- a/apps/cloud/src/org/compose.ts +++ /dev/null @@ -1,6 +0,0 @@ -import { HttpApi } from "effect/unstable/httpapi"; -import { OrgAuth } from "../auth/middleware"; -import { OrgApi } from "./api"; - -/** Org API with org-level auth — requires authenticated session with an org. */ -export const OrgHttpApi = HttpApi.make("org").add(OrgApi).middleware(OrgAuth); diff --git a/apps/cloud/src/org/handlers.test.ts b/apps/cloud/src/org/handlers.test.ts index 9040f7bff..da60e9183 100644 --- a/apps/cloud/src/org/handlers.test.ts +++ b/apps/cloud/src/org/handlers.test.ts @@ -1,25 +1,27 @@ import { describe, it, expect } from "@effect/vitest"; import { Data, Effect, Layer } from "effect"; -import { AuthContext } from "../auth/middleware"; -import { WorkOSAuth, type WorkOSAuthService } from "../auth/workos"; +import { AuthContext } from "@executor-js/api/server"; +import { WorkOSClient, type WorkOSClientService } from "../auth/workos"; import { Forbidden } from "./api"; // --------------------------------------------------------------------------- -// Stub factory — only implement what each test calls +// Domain-handler guards. The member / role / invite / org-name endpoints moved +// to the shared WorkOS `AccountProvider` (covered by +// `workos-account-service.test.ts`); this group now serves only the WorkOS +// domain-verification endpoints. These tests pin the two guards those handlers +// share — `requireAdmin` and `assertDomainInSessionOrg` — which mirror +// `org/handlers.ts`. // --------------------------------------------------------------------------- // eslint-disable-next-line @typescript-eslint/no-explicit-any -- test stub needs wide function types -type StubFn = (...args: never[]) => Effect.Effect; +type StubFn = (...args: never[]) => Effect.Effect; type StubOverrides = { - listOrgMembers?: StubFn; getUserOrgMembership?: StubFn; - getUser?: StubFn; - sendInvitation?: StubFn; - deleteOrgMembership?: StubFn; - updateOrgMembershipRole?: StubFn; - listOrgRoles?: StubFn; + getOrganizationDomain?: StubFn; + getOrganization?: StubFn; + deleteOrganizationDomain?: StubFn; }; class UnstubbedWorkOSMethod extends Data.TaggedError("UnstubbedWorkOSMethod")<{ @@ -28,8 +30,8 @@ class UnstubbedWorkOSMethod extends Data.TaggedError("UnstubbedWorkOSMethod")<{ const stubWorkOS = (overrides: StubOverrides = {}) => Layer.succeed( - WorkOSAuth, - new Proxy({} as WorkOSAuthService, { + WorkOSClient, + new Proxy({} as WorkOSClientService, { get: (_target, prop) => { if (typeof prop === "string" && prop in overrides) { return overrides[prop as keyof StubOverrides]; @@ -44,16 +46,13 @@ const stubWorkOS = (overrides: StubOverrides = {}) => }), ); -// --------------------------------------------------------------------------- -// Fixtures -// --------------------------------------------------------------------------- - const adminAuth = { accountId: "user_admin", organizationId: "org_1", email: "admin@test.com", name: "Admin", avatarUrl: null, + roles: [], }; const memberAuth = { @@ -62,158 +61,51 @@ const memberAuth = { email: "member@test.com", name: "Member", avatarUrl: null, + roles: [], }; -type FakeMembership = { - id: string; - userId: string; - status: string; - role: { slug: string }; -}; -type FakeUser = { - email: string; - firstName: string | null; - lastName: string | null; - profilePictureUrl: string | null; - lastSignInAt: string | null; -}; -type FakeRole = { slug: string; name: string }; - -const fakeMemberships: FakeMembership[] = [ - { - id: "mem_admin", - userId: "user_admin", - status: "active", - role: { slug: "admin" }, - }, - { - id: "mem_member", - userId: "user_member", - status: "active", - role: { slug: "member" }, - }, -]; - -const fakeUsers: Record = { - user_admin: { - email: "admin@test.com", - firstName: "Admin", - lastName: null, - profilePictureUrl: null, - lastSignInAt: "2026-04-09T00:00:00Z", - }, - user_member: { - email: "member@test.com", - firstName: "Member", - lastName: null, - profilePictureUrl: null, - lastSignInAt: null, - }, -}; - -const fakeRoles: FakeRole[] = [ - { slug: "admin", name: "Admin" }, - { slug: "member", name: "Member" }, -]; - -// --------------------------------------------------------------------------- -// The admin guard — mirrors handlers.ts -// --------------------------------------------------------------------------- +const provide = (auth: typeof adminAuth, workosOverrides: StubOverrides = {}) => + Layer.mergeAll(Layer.succeed(AuthContext)(auth), stubWorkOS(workosOverrides)); +// Mirrors `org/handlers.ts` `requireAdmin`. const requireAdmin = Effect.gen(function* () { const auth = yield* AuthContext; - const workos = yield* WorkOSAuth; + const workos = yield* WorkOSClient; const current = yield* workos.getUserOrgMembership(auth.organizationId, auth.accountId); if (!current || current.role?.slug !== "admin") { return yield* new Forbidden(); } }); -const provide = (auth: typeof adminAuth, workosOverrides: StubOverrides = {}) => - Layer.mergeAll(Layer.succeed(AuthContext)(auth), stubWorkOS(workosOverrides)); - -const withMembers: StubOverrides = { - listOrgMembers: () => Effect.succeed({ data: fakeMemberships }), -}; - const withCurrentMembership: StubOverrides = { getUserOrgMembership: (_organizationId: string, userId: string) => - Effect.succeed(fakeMemberships.find((m) => m.userId === userId) ?? null), + Effect.succeed( + userId === "user_admin" + ? { id: "mem_admin", userId, status: "active", role: { slug: "admin" } } + : { id: "mem_member", userId, status: "active", role: { slug: "member" } }, + ), }; -// --------------------------------------------------------------------------- -// Tests -// --------------------------------------------------------------------------- - -describe("Org handlers", () => { - describe("listMembers", () => { - it.effect("returns members with isCurrentUser set correctly", () => - Effect.gen(function* () { - const auth = yield* AuthContext; - const workos = yield* WorkOSAuth; - const result = yield* workos.listOrgMembers(auth.organizationId); - const members = yield* Effect.all( - result.data.map((m: FakeMembership) => - Effect.gen(function* () { - const user = yield* workos.getUser(m.userId); - return { - id: m.id, - email: user.email, - role: m.role?.slug ?? "member", - isCurrentUser: m.userId === auth.accountId, - }; - }), - ), - ); - - expect(members).toHaveLength(2); - expect(members[0]).toMatchObject({ - email: "admin@test.com", - isCurrentUser: true, - }); - expect(members[1]).toMatchObject({ - email: "member@test.com", - isCurrentUser: false, - }); - }).pipe( - Effect.provide( - provide(adminAuth, { - ...withMembers, - getUser: (id: string) => Effect.succeed(fakeUsers[id]), - }), - ), - ), - ); - }); - - describe("listRoles", () => { - it.effect("returns available roles", () => - Effect.gen(function* () { - const auth = yield* AuthContext; - const workos = yield* WorkOSAuth; - const result = yield* workos.listOrgRoles(auth.organizationId); - const roles = result.data.map((r: FakeRole) => ({ - slug: r.slug, - name: r.name, - })); - - expect(roles).toEqual(fakeRoles); - }).pipe( - Effect.provide( - provide(adminAuth, { - listOrgRoles: () => Effect.succeed({ data: fakeRoles }), - }), - ), - ), - ); +// Mirrors `org/handlers.ts` `assertDomainInSessionOrg`. +const assertDomainInSessionOrg = (domainId: string) => + Effect.gen(function* () { + const auth = yield* AuthContext; + const workos = yield* WorkOSClient; + const domain = yield* workos + .getOrganizationDomain(domainId) + .pipe(Effect.catchCause(() => Effect.succeed(null))); + if (!domain || domain.organizationId !== auth.organizationId) { + return yield* new Forbidden(); + } }); +describe("Org domain handlers", () => { describe("requireAdmin", () => { - it.effect("passes for admin user", () => + it.effect("passes for an admin caller", () => requireAdmin.pipe(Effect.provide(provide(adminAuth, withCurrentMembership))), ); - it.effect("rejects non-admin with Forbidden", () => + it.effect("rejects a non-admin caller with Forbidden", () => Effect.gen(function* () { const error = yield* Effect.flip(requireAdmin); expect(error).toBeInstanceOf(Forbidden); @@ -221,103 +113,43 @@ describe("Org handlers", () => { ); }); - describe("invite (admin-gated)", () => { - it.effect("admin can invite", () => - Effect.gen(function* () { - yield* requireAdmin; - const auth = yield* AuthContext; - const workos = yield* WorkOSAuth; - const result = yield* workos.sendInvitation({ - email: "new@test.com", - organizationId: auth.organizationId, - }); - - expect(result.email).toBe("new@test.com"); - }).pipe( + describe("assertDomainInSessionOrg", () => { + it.effect("passes when the domain belongs to the session org", () => + assertDomainInSessionOrg("dom_1").pipe( Effect.provide( provide(adminAuth, { - ...withCurrentMembership, - sendInvitation: (p: { email: string }) => - Effect.succeed({ id: "inv_1", email: p.email }), + getOrganizationDomain: () => + Effect.succeed({ id: "dom_1", organizationId: "org_1", domain: "acme.test" }), }), ), ), ); - it.effect("member cannot invite", () => + it.effect("rejects a domain owned by a different org with Forbidden", () => Effect.gen(function* () { - const error = yield* Effect.flip( - Effect.gen(function* () { - yield* requireAdmin; - const workos = yield* WorkOSAuth; - yield* workos.sendInvitation({ - email: "x", - organizationId: "org_1", - }); - }), - ); + const error = yield* Effect.flip(assertDomainInSessionOrg("dom_other")); expect(error).toBeInstanceOf(Forbidden); - }).pipe(Effect.provide(provide(memberAuth, withCurrentMembership))), - ); - }); - - describe("removeMember (admin-gated)", () => { - it.effect("admin can remove", () => - Effect.gen(function* () { - yield* requireAdmin; - const workos = yield* WorkOSAuth; - yield* workos.deleteOrgMembership("mem_member"); }).pipe( Effect.provide( provide(adminAuth, { - ...withCurrentMembership, - deleteOrgMembership: () => Effect.void, + getOrganizationDomain: () => + Effect.succeed({ id: "dom_other", organizationId: "org_2", domain: "evil.test" }), }), ), ), ); - it.effect("member cannot remove", () => + it.effect("rejects (Forbidden) when the domain lookup fails — never leaks existence", () => Effect.gen(function* () { - const error = yield* Effect.flip( - Effect.gen(function* () { - yield* requireAdmin; - const workos = yield* WorkOSAuth; - yield* workos.deleteOrgMembership("mem_admin"); - }), - ); + const error = yield* Effect.flip(assertDomainInSessionOrg("dom_missing")); expect(error).toBeInstanceOf(Forbidden); - }).pipe(Effect.provide(provide(memberAuth, withCurrentMembership))), - ); - }); - - describe("updateMemberRole (admin-gated)", () => { - it.effect("admin can change role", () => - Effect.gen(function* () { - yield* requireAdmin; - const workos = yield* WorkOSAuth; - yield* workos.updateOrgMembershipRole("mem_member", "admin"); }).pipe( Effect.provide( provide(adminAuth, { - ...withCurrentMembership, - updateOrgMembershipRole: () => Effect.void, + getOrganizationDomain: () => Effect.fail(new UnstubbedWorkOSMethod({ method: "boom" })), }), ), ), ); - - it.effect("member cannot change role", () => - Effect.gen(function* () { - const error = yield* Effect.flip( - Effect.gen(function* () { - yield* requireAdmin; - const workos = yield* WorkOSAuth; - yield* workos.updateOrgMembershipRole("mem_admin", "member"); - }), - ); - expect(error).toBeInstanceOf(Forbidden); - }).pipe(Effect.provide(provide(memberAuth, withCurrentMembership))), - ); }); }); diff --git a/apps/cloud/src/org/handlers.ts b/apps/cloud/src/org/handlers.ts index 4309b238f..cd888c27d 100644 --- a/apps/cloud/src/org/handlers.ts +++ b/apps/cloud/src/org/handlers.ts @@ -1,49 +1,40 @@ import { HttpApiBuilder } from "effect/unstable/httpapi"; -import { Cause, Effect } from "effect"; +import { Effect } from "effect"; -import { UserStoreService } from "../auth/context"; -import { AuthContext } from "../auth/middleware"; +import { AuthContext } from "@executor-js/api/server"; import { env } from "cloudflare:workers"; -import { WorkOSAuth } from "../auth/workos"; +import { WorkOSClient } from "../auth/workos"; import { AutumnService } from "../services/autumn"; -import { OrgHttpApi } from "./compose"; -import { Forbidden } from "./api"; -import { getMemberLimitForPlan, selectActiveMemberLimitPlan } from "./member-limits"; +import { Forbidden, OrgHttpApi } from "./api"; + +// --------------------------------------------------------------------------- +// Cloud-local org handlers — WorkOS domain-verification only. Members / roles / +// invite / org-name are served by the shared WorkOS `AccountProvider` over +// `/account/*`; this group covers the cloud-only domain endpoints behind +// `OrgAuth` (org-scoped cookie session). +// --------------------------------------------------------------------------- const requireAdmin = Effect.gen(function* () { const auth = yield* AuthContext; - const workos = yield* WorkOSAuth; + const workos = yield* WorkOSClient; const currentMembership = yield* workos.getUserOrgMembership(auth.organizationId, auth.accountId); if (!currentMembership || currentMembership.role?.slug !== "admin") { return yield* new Forbidden(); } }); -// Target-ownership checks — independent of caller privilege. `requireAdmin` -// confirms the caller is an admin of their session's org; these confirm the -// resource they're about to mutate actually lives in that same org. Without -// this, an admin of org A who obtained a membership/domain id from org B -// (leak, screenshot, support context) could trigger the WorkOS SDK against -// org B's resource — the workspace API key is workspace-wide and WorkOS -// does not enforce per-org ownership on delete/update by id. Failures -// (not found OR org mismatch) both surface as Forbidden so we don't leak -// existence of ids outside the caller's org. -const assertMembershipInSessionOrg = (membershipId: string) => - Effect.gen(function* () { - const auth = yield* AuthContext; - const workos = yield* WorkOSAuth; - const membership = yield* workos - .getOrgMembership(membershipId) - .pipe(Effect.catchCause(() => Effect.succeed(null))); - if (!membership || membership.organizationId !== auth.organizationId) { - return yield* new Forbidden(); - } - }); - +// Target-ownership check — independent of caller privilege. `requireAdmin` +// confirms the caller is an admin of their session's org; this confirms the +// domain they're about to delete actually lives in that same org. Without it, +// an admin of org A who obtained a domain id from org B (leak, screenshot, +// support context) could trigger the WorkOS SDK against org B's resource — the +// workspace API key is workspace-wide and WorkOS does not enforce per-org +// ownership on delete by id. Failures (not found OR org mismatch) both surface +// as Forbidden so we don't leak existence of ids outside the caller's org. const assertDomainInSessionOrg = (domainId: string) => Effect.gen(function* () { const auth = yield* AuthContext; - const workos = yield* WorkOSAuth; + const workos = yield* WorkOSClient; const domain = yield* workos .getOrganizationDomain(domainId) .pipe(Effect.catchCause(() => Effect.succeed(null))); @@ -52,167 +43,12 @@ const assertDomainInSessionOrg = (domainId: string) => } }); -// Compute live seat usage from WorkOS truth (active+pending memberships + -// pending invitations) and look up the per-plan cap from MEMBER_LIMITS. -// Recomputed on every call — no event-counting drift. -const getMemberSeats = (organizationId: string) => - Effect.gen(function* () { - const autumn = yield* AutumnService; - const workos = yield* WorkOSAuth; - - const customer = yield* autumn.use((client) => - client.customers.getOrCreate({ customerId: organizationId }), - ); - const planId = selectActiveMemberLimitPlan(customer.subscriptions); - const limit = getMemberLimitForPlan(planId); - - const memberships = yield* workos.listOrgMembers(organizationId); - const invitations = yield* workos.listPendingInvitations(organizationId); - - return { - used: memberships.data.length + invitations.data.length, - granted: limit ?? 0, - unlimited: limit === null, - }; - }); - -const reserveMemberSlot = Effect.gen(function* () { - const auth = yield* AuthContext; - const seats = yield* getMemberSeats(auth.organizationId).pipe( - Effect.tap((s) => - Effect.logInfo("members.check").pipe( - Effect.annotateLogs({ - "org.id": auth.organizationId, - "members.used": s.used, - "members.granted": s.granted, - "members.unlimited": s.unlimited, - }), - ), - ), - Effect.catchCause((cause) => - Effect.gen(function* () { - yield* Effect.logError("members.seats lookup failed; failing closed").pipe( - Effect.annotateLogs({ "org.id": auth.organizationId, cause: Cause.pretty(cause) }), - ); - return yield* new Forbidden(); - }), - ), - ); - - if (!seats.unlimited && seats.used >= seats.granted) { - return yield* new Forbidden(); - } -}); - export const OrgHandlers = HttpApiBuilder.group(OrgHttpApi, "org", (handlers) => handlers - .handle("listMembers", () => - Effect.gen(function* () { - const auth = yield* AuthContext; - const workos = yield* WorkOSAuth; - - // The list endpoint falls back to safe display defaults if the seats - // lookup errors — we never want a transient Autumn or WorkOS hiccup - // to blank the members page. The actual cap gate lives in - // `reserveMemberSlot`, which fails closed. - const seats = yield* getMemberSeats(auth.organizationId).pipe( - Effect.catchTag("AutumnError", (error) => - Effect.logError("listMembers.seats: autumn lookup failed").pipe( - Effect.annotateLogs({ "org.id": auth.organizationId, error: String(error.cause) }), - Effect.as({ used: 0, granted: 0, unlimited: false }), - ), - ), - ); - - const memberships = yield* workos.listOrgMembers(auth.organizationId); - - yield* Effect.logInfo("listMembers.seats").pipe( - Effect.annotateLogs({ - "org.id": auth.organizationId, - "members.count": memberships.data.length, - "seats.used": seats.used, - "seats.granted": seats.granted, - "seats.unlimited": seats.unlimited, - }), - ); - - const members = yield* Effect.all( - memberships.data.map((m) => - Effect.gen(function* () { - const user = yield* workos.getUser(m.userId); - return { - id: m.id, - userId: m.userId, - email: user.email, - name: [user.firstName, user.lastName].filter(Boolean).join(" ") || null, - avatarUrl: user.profilePictureUrl ?? null, - role: m.role?.slug ?? "member", - status: m.status, - lastActiveAt: user.lastSignInAt ?? null, - isCurrentUser: m.userId === auth.accountId, - }; - }), - ), - { concurrency: 5 }, - ); - - return { members, seats }; - }), - ) - .handle("listRoles", () => - Effect.gen(function* () { - const auth = yield* AuthContext; - const workos = yield* WorkOSAuth; - - const result = yield* workos.listOrgRoles(auth.organizationId); - - return { - roles: result.data.map((r) => ({ - slug: r.slug, - name: r.name, - })), - }; - }), - ) - .handle("invite", ({ payload }) => - Effect.gen(function* () { - yield* requireAdmin; - const auth = yield* AuthContext; - const workos = yield* WorkOSAuth; - - yield* reserveMemberSlot; - - const invitation = yield* workos.sendInvitation({ - email: payload.email, - organizationId: auth.organizationId, - roleSlug: payload.roleSlug, - }); - - return { id: invitation.id, email: invitation.email }; - }), - ) - .handle("removeMember", ({ params }) => - Effect.gen(function* () { - yield* requireAdmin; - yield* assertMembershipInSessionOrg(params.membershipId); - const workos = yield* WorkOSAuth; - yield* workos.deleteOrgMembership(params.membershipId); - return { success: true }; - }), - ) - .handle("updateMemberRole", ({ params, payload }) => - Effect.gen(function* () { - yield* requireAdmin; - yield* assertMembershipInSessionOrg(params.membershipId); - const workos = yield* WorkOSAuth; - yield* workos.updateOrgMembershipRole(params.membershipId, payload.roleSlug); - return { success: true }; - }), - ) .handle("listDomains", () => Effect.gen(function* () { const auth = yield* AuthContext; - const workos = yield* WorkOSAuth; + const workos = yield* WorkOSClient; const org = yield* workos.getOrganization(auth.organizationId); const domains = yield* Effect.all( @@ -253,7 +89,7 @@ export const OrgHandlers = HttpApiBuilder.group(OrgHttpApi, "org", (handlers) => return yield* new Forbidden(); } - const workos = yield* WorkOSAuth; + const workos = yield* WorkOSClient; const { link } = yield* workos.generateDomainVerificationPortalLink( auth.organizationId, env.VITE_PUBLIC_SITE_URL ? `${env.VITE_PUBLIC_SITE_URL}/org` : "/org", @@ -265,20 +101,9 @@ export const OrgHandlers = HttpApiBuilder.group(OrgHttpApi, "org", (handlers) => Effect.gen(function* () { yield* requireAdmin; yield* assertDomainInSessionOrg(params.domainId); - const workos = yield* WorkOSAuth; + const workos = yield* WorkOSClient; yield* workos.deleteOrganizationDomain(params.domainId); return { success: true }; }), - ) - .handle("updateOrgName", ({ payload }) => - Effect.gen(function* () { - yield* requireAdmin; - const auth = yield* AuthContext; - const workos = yield* WorkOSAuth; - const users = yield* UserStoreService; - const org = yield* workos.updateOrganization(auth.organizationId, payload.name); - yield* users.use((s) => s.upsertOrganization({ id: org.id, name: org.name })); - return { name: org.name }; - }), ), ); diff --git a/apps/cloud/src/org/member-limits.ts b/apps/cloud/src/org/member-limits.ts deleted file mode 100644 index 8cff10069..000000000 --- a/apps/cloud/src/org/member-limits.ts +++ /dev/null @@ -1,28 +0,0 @@ -import { ACTIVE_AUTUMN_SUBSCRIPTION_STATUSES } from "../services/autumn-plans"; - -const MEMBER_LIMITS: Record = { - free: 3, - "free-pay-as-you-go": 3, - team: null, - enterprise: null, -}; - -export const DEFAULT_MEMBER_LIMIT = 3; - -export type AutumnSubscriptionSummary = { - readonly planId?: string | null; - readonly status?: string | null; -}; - -export const selectActiveMemberLimitPlan = ( - subscriptions: ReadonlyArray, -): string => { - const active = - subscriptions.find((subscription) => - ACTIVE_AUTUMN_SUBSCRIPTION_STATUSES.has(subscription.status ?? ""), - ) ?? subscriptions[0]; - return active?.planId ?? "free"; -}; - -export const getMemberLimitForPlan = (planId: string): number | null => - planId in MEMBER_LIMITS ? MEMBER_LIMITS[planId] : DEFAULT_MEMBER_LIMIT; diff --git a/apps/cloud/src/routes/api-keys.tsx b/apps/cloud/src/routes/api-keys.tsx index e12db738f..ce5afe51c 100644 --- a/apps/cloud/src/routes/api-keys.tsx +++ b/apps/cloud/src/routes/api-keys.tsx @@ -1,272 +1,8 @@ -import { useState } from "react"; -import { Exit } from "effect"; -import * as AsyncResult from "effect/unstable/reactivity/AsyncResult"; import { createFileRoute } from "@tanstack/react-router"; -import { useAtomSet, useAtomValue } from "@effect/atom-react"; -import { toast } from "sonner"; -import { apiKeyWriteKeys } from "@executor-js/react/api/reactivity-keys"; -import { Button } from "@executor-js/react/components/button"; -import { CopyButton } from "@executor-js/react/components/copy-button"; -import { - Dialog, - DialogClose, - DialogContent, - DialogDescription, - DialogFooter, - DialogHeader, - DialogTitle, -} from "@executor-js/react/components/dialog"; -import { Input } from "@executor-js/react/components/input"; -import { Label } from "@executor-js/react/components/label"; -import { apiKeysAtom, createApiKey, revokeApiKey } from "../web/api-key-atoms"; +import { ApiKeysPage } from "@executor-js/react/pages/api-keys"; +// Cloud renders the SHARED API-keys page over the provider-neutral +// `/account/api-keys` surface — identical UI to self-host. export const Route = createFileRoute("/api-keys")({ component: ApiKeysPage, }); - -type ApiKeySummary = { - readonly id: string; - readonly name: string; - readonly obfuscatedValue: string; - readonly createdAt: string; - readonly lastUsedAt: string | null; -}; - -type CreatedKey = ApiKeySummary & { - readonly value: string; -}; - -const formatDate = (value: string | null): string => { - if (!value) return "Never"; - const date = new Date(value); - return Number.isNaN(date.getTime()) - ? value - : new Intl.DateTimeFormat(undefined, { - month: "short", - day: "numeric", - year: "numeric", - }).format(date); -}; - -const defaultApiKeyName = (): string => - `API key ${new Intl.DateTimeFormat(undefined, { - month: "short", - day: "numeric", - year: "numeric", - }).format(new Date())}`; - -function ApiKeysPage() { - const result = useAtomValue(apiKeysAtom); - const doCreate = useAtomSet(createApiKey, { mode: "promiseExit" }); - const doRevoke = useAtomSet(revokeApiKey, { mode: "promiseExit" }); - const [createOpen, setCreateOpen] = useState(false); - const [name, setName] = useState(""); - const [createdKey, setCreatedKey] = useState(null); - const [creating, setCreating] = useState(false); - const [revokingId, setRevokingId] = useState(null); - - const handleCreate = async () => { - const trimmed = name.trim(); - if (!trimmed) return; - setCreating(true); - const exit = await doCreate({ - payload: { name: trimmed }, - reactivityKeys: apiKeyWriteKeys, - }); - setCreating(false); - if (Exit.isSuccess(exit)) { - setCreatedKey(exit.value); - setName(""); - toast.success("API key created"); - return; - } - toast.error("Failed to create API key"); - }; - - const handleRevoke = async (key: ApiKeySummary) => { - setRevokingId(key.id); - const exit = await doRevoke({ - params: { apiKeyId: key.id }, - reactivityKeys: apiKeyWriteKeys, - }); - setRevokingId(null); - if (Exit.isSuccess(exit)) { - toast.success(`Revoked ${key.name}`); - return; - } - toast.error("Failed to revoke API key"); - }; - - const closeCreate = (open: boolean) => { - setCreateOpen(open); - if (!open) { - setName(""); - setCreatedKey(null); - setCreating(false); - } - }; - - return ( -
-
-
-
-

API keys

-

- User keys for accessing the Executor API and MCP endpoint from scripts and tools. -

-
- - Authorization: Bearer <api-key> - - -
-

- API keys work as PATs and have full access to your account. -

-
- -
- - {AsyncResult.match(result, { - onInitial: () => ( -
- Loading API keys... -
- ), - onFailure: () => ( -
- Failed to load API keys -
- ), - onSuccess: ({ value }) => - value.apiKeys.length === 0 ? ( -
-

No API keys

-

- Create a key and send it in the Authorization Bearer header. -

-
- ) : ( -
-
- Name - Created - Last used - Actions -
- {value.apiKeys.map((key: ApiKeySummary) => ( -
-
-

{key.name}

-

- {key.obfuscatedValue} -

-
-

- {formatDate(key.createdAt)} -

-

- {formatDate(key.lastUsedAt)} -

- -
- ))} -
- ), - })} -
- - - - - Create API key - - The key will act as your user in the current organization. - - - - {createdKey ? ( -
-
- -
- - -
-
-
- -
- - -
-
-

- Send this value as a Bearer token. It is only shown once. -

-
- ) : ( -
-
- - setName(event.target.value)} - placeholder="Local CLI" - maxLength={80} - autoFocus - /> -
-
- )} - - - - - - {!createdKey && ( - - )} - - - -
- ); -} diff --git a/apps/cloud/src/routes/org.tsx b/apps/cloud/src/routes/org.tsx index 6b7ab7b3d..43edadffb 100644 --- a/apps/cloud/src/routes/org.tsx +++ b/apps/cloud/src/routes/org.tsx @@ -1,203 +1,102 @@ -import { useReducer, useState } from "react"; -import { Cause, Exit, Match, Result } from "effect"; -import { Forbidden } from "../org/api"; import { createFileRoute, Link } from "@tanstack/react-router"; +import { Exit } from "effect"; import { useAtomValue, useAtomSet } from "@effect/atom-react"; import * as AsyncResult from "effect/unstable/reactivity/AsyncResult"; import { useCustomer } from "autumn-js/react"; import { toast } from "sonner"; -import { - orgMemberWriteKeys, - orgDomainWriteKeys, - orgInfoWriteKeys, -} from "@executor-js/react/api/reactivity-keys"; -import { - Dialog, - DialogContent, - DialogHeader, - DialogTitle, - DialogDescription, - DialogFooter, - DialogClose, -} from "@executor-js/react/components/dialog"; +import { orgDomainWriteKeys } from "@executor-js/react/api/reactivity-keys"; import { Button } from "@executor-js/react/components/button"; import { Badge } from "@executor-js/react/components/badge"; import { CopyButton } from "@executor-js/react/components/copy-button"; -import { Input } from "@executor-js/react/components/input"; -import { Label } from "@executor-js/react/components/label"; -import { - Select, - SelectContent, - SelectItem, - SelectTrigger, - SelectValue, -} from "@executor-js/react/components/select"; import { DropdownMenu, DropdownMenuContent, DropdownMenuItem, - DropdownMenuSub, - DropdownMenuSubContent, - DropdownMenuSubTrigger, DropdownMenuTrigger, - DropdownMenuSeparator, } from "@executor-js/react/components/dropdown-menu"; -import { - orgMembersAtom, - orgRolesAtom, - orgDomainsAtom, - inviteMember, - removeMember, - updateMemberRole, - getDomainVerificationLink, - deleteDomain, - updateOrgName, -} from "../web/org-atoms"; -import { useAuth } from "../web/auth"; +import { OrgPage as SharedOrgPage } from "@executor-js/react/pages/org"; +import { orgMembersAtom } from "@executor-js/react/api/account-atoms"; +import { orgDomainsAtom, getDomainVerificationLink, deleteDomain } from "../web/org-atoms"; + +// --------------------------------------------------------------------------- +// Cloud organization page. The members / roles / invite / org-name surface is +// the SHARED `@executor-js/react` OrgPage over the provider-neutral +// `/account/*` atoms — identical to self-host. Cloud composes its WorkOS-only +// extras AROUND that page: +// - a seat/billing banner (Autumn member-limit upsell) +// - the WorkOS domain-verification section (over the surviving cloud-local +// `/org/domains` endpoints) +// These are cloud additions, not a fork of the shared page. +// --------------------------------------------------------------------------- export const Route = createFileRoute("/org")({ component: OrgPage, }); -type InviteState = { - email: string; - roleSlug: string; - status: "idle" | "sending" | "error"; - failure: Cause.Cause | null; -}; - -const initialInviteState: InviteState = { - email: "", - roleSlug: "member", - status: "idle", - failure: null, +type DomainData = { + id: string; + domain: string; + state: string; + verificationToken?: string; + verificationPrefix?: string; }; -type InviteAction = - | { type: "setEmail"; email: string } - | { type: "setRole"; roleSlug: string } - | { type: "send" } - | { type: "error"; cause: Cause.Cause } - | { type: "reset" }; - -function inviteReducer(state: InviteState, action: InviteAction): InviteState { - return Match.value(action).pipe( - Match.discriminator("type")("setEmail", (a) => ({ ...state, email: a.email })), - Match.discriminator("type")("setRole", (a) => ({ ...state, roleSlug: a.roleSlug })), - Match.discriminator("type")("send", () => ({ - ...state, - status: "sending" as const, - failure: null, - })), - Match.discriminator("type")("error", (a) => ({ - ...state, - status: "error" as const, - failure: a.cause, - })), - Match.discriminator("type")("reset", () => initialInviteState), - Match.exhaustive, +function OrgPage() { + return ( +
+
+ + +
+ {/* Shared members / roles / invite / org-name surface. */} + +
); } -function formatLastActive(lastActiveAt: string | null): string { - if (!lastActiveAt) return "\u2014"; - const date = new Date(lastActiveAt); - const diffMs = Date.now() - date.getTime(); - const diffMins = Math.floor(diffMs / 60000); - if (diffMins < 1) return "Just now"; - if (diffMins < 60) return `${diffMins}m ago`; - const diffHours = Math.floor(diffMins / 60); - if (diffHours < 24) return `${diffHours}h ago`; - const diffDays = Math.floor(diffHours / 24); - if (diffDays < 30) return `${diffDays}d ago`; - return date.toLocaleDateString(undefined, { month: "short", day: "numeric" }); +// Autumn-backed member-seat banner. The hard cap is enforced server-side in +// the `/account/inviteMember` handler (AccountForbidden), so this is purely an +// affordance: surface the upgrade CTA once the org is at/over its seat limit. +function MemberLimitBanner() { + const membersResult = useAtomValue(orgMembersAtom); + const seats = AsyncResult.match(membersResult, { + onInitial: () => null, + onFailure: () => null, + onSuccess: ({ value }) => value.seats ?? null, + }); + const atLimit = seats ? !seats.unlimited && seats.used >= seats.granted : false; + if (!atLimit) return null; + return ( +
+

+ You've reached your member limit. Upgrade to Team to invite more. +

+ + + +
+ ); } -function OrgPage() { - const auth = useAuth(); - const orgName = - auth.status === "authenticated" ? (auth.organization?.name ?? "Organization") : "Organization"; - const membersResult = useAtomValue(orgMembersAtom); - const rolesResult = useAtomValue(orgRolesAtom); +function DomainsSection() { const domainsResult = useAtomValue(orgDomainsAtom); - const doRemove = useAtomSet(removeMember, { mode: "promiseExit" }); - const doUpdateRole = useAtomSet(updateMemberRole, { mode: "promiseExit" }); const doDeleteDomain = useAtomSet(deleteDomain, { mode: "promiseExit" }); const doGetVerificationLink = useAtomSet(getDomainVerificationLink, { mode: "promiseExit" }); - const doUpdateOrgName = useAtomSet(updateOrgName, { mode: "promiseExit" }); const { check, isLoading: customerLoading } = useCustomer(); const canUseDomains = customerLoading ? false : check({ featureId: "domain-verification" }).allowed; - const seats = AsyncResult.match(membersResult, { - onInitial: () => null, - onFailure: () => null, - onSuccess: ({ value }) => value.seats ?? null, - }); - const canInviteMember = !seats ? false : seats.unlimited || seats.used < seats.granted; - const [inviteOpen, setInviteOpen] = useState(false); - const [editName, setEditName] = useState(orgName); - const [savingName, setSavingName] = useState(false); - const [search, setSearch] = useState(""); - - const roles = AsyncResult.match(rolesResult, { - onInitial: () => [] as readonly { slug: string; name: string }[], - onFailure: () => [] as readonly { slug: string; name: string }[], - onSuccess: ({ value }) => value.roles, - }); - - const handleRemove = async (membershipId: string, name: string) => { - const exit = await doRemove({ params: { membershipId }, reactivityKeys: orgMemberWriteKeys }); - if (Exit.isSuccess(exit)) { - toast.success(`Removed ${name}`); - } else { - toast.error("Failed to remove member"); - } - }; - - const handleChangeRole = async (membershipId: string, roleSlug: string, roleName: string) => { - const exit = await doUpdateRole({ - params: { membershipId }, - payload: { roleSlug }, - reactivityKeys: orgMemberWriteKeys, - }); - if (Exit.isSuccess(exit)) { - toast.success(`Role changed to ${roleName}`); - } else { - toast.error("Failed to change role"); - } - }; - - const handleSaveName = async () => { - const trimmed = editName.trim(); - if (!trimmed || trimmed === orgName) { - setEditName(orgName); - return; - } - setSavingName(true); - const exit = await doUpdateOrgName({ - payload: { name: trimmed }, - reactivityKeys: orgInfoWriteKeys, - }); - if (Exit.isSuccess(exit)) { - toast.success("Organization name updated"); - } else { - toast.error("Failed to update organization name"); - setEditName(orgName); - } - setSavingName(false); - }; const handleDeleteDomain = async (domainId: string, domain: string) => { const exit = await doDeleteDomain({ params: { domainId }, reactivityKeys: orgDomainWriteKeys, }); - if (Exit.isSuccess(exit)) { - toast.success(`Removed ${domain}`); - } else { - toast.error("Failed to remove domain"); - } + toast[Exit.isSuccess(exit) ? "success" : "error"]( + Exit.isSuccess(exit) ? `Removed ${domain}` : "Failed to remove domain", + ); }; const handleAddDomain = async () => { @@ -210,326 +109,72 @@ function OrgPage() { }; return ( -
-
- {/* Header */} -
-

Organization

+
+
+
+

Domains

+

+ Verify a domain to let anyone with a matching email join automatically. +

+ +
- {/* Settings */} -
-
-
- - setEditName((e.target as HTMLInputElement).value)} - onKeyDown={(e) => { - if (e.key === "Enter") handleSaveName(); - }} - className="mt-1.5 h-9 text-sm" - /> -
- {editName.trim() !== orgName && editName.trim() !== "" && ( - - )} -
-
- - {/* Domains */} -
-
-
-

Domains

-

- Verify a domain to let anyone with a matching email join automatically. -

-
- -
- - {!canUseDomains && ( -
-

- Join by domain is available on the Team plan. -

- - - -
- )} - - {AsyncResult.match(domainsResult, { - onInitial: () => ( -
- {[1, 2].map((i) => ( -
- ))} -
- ), - onFailure: () => ( -
-

Failed to load domains

-
- ), - onSuccess: ({ value }) => { - if (value.domains.length === 0) { - if (!canUseDomains) return null; - return ( -

- No domains yet. Add your company domain so members can join without an invite. -

- ); - } - - return ( -
- {value.domains.map((d: DomainData) => ( - handleDeleteDomain(d.id, d.domain)} - /> - ))} -
- ); - }, - })} -
+ +
+ )} - {/* Members */} -
-
-
-

Members

-

- Free organizations can include up to 3 members. + {AsyncResult.match(domainsResult, { + onInitial: () => ( +

+ {[1, 2].map((i) => ( +
+ ))} +
+ ), + onFailure: () => ( +
+

Failed to load domains

+
+ ), + onSuccess: ({ value }) => { + if (value.domains.length === 0) { + if (!canUseDomains) return null; + return ( +

+ No domains yet. Add your company domain so members can join without an invite.

+ ); + } + + return ( +
+ {value.domains.map((d: DomainData) => ( + handleDeleteDomain(d.id, d.domain)} + /> + ))}
- {canInviteMember ? ( - - ) : ( - - - - )} -
- setSearch((e.target as HTMLInputElement).value)} - className="mb-3 h-9 text-sm" - /> - - {AsyncResult.match(membersResult, { - onInitial: () => ( -
- {[1, 2, 3].map((i) => ( -
- ))} -
- ), - onFailure: () => ( -
-

Failed to load members

-
- ), - onSuccess: ({ value }) => { - const members = value.members; - const filtered = search - ? members.filter( - (m: MemberData) => - m.email.toLowerCase().includes(search.toLowerCase()) || - (m.name?.toLowerCase().includes(search.toLowerCase()) ?? false), - ) - : members; - - if (filtered.length === 0) { - return ( -

- {search ? "No matching members" : "No members yet"} -

- ); - } - - return ( -
- {filtered.map((member: MemberData) => ( -
- {/* Avatar */} - {member.avatarUrl ? ( - - ) : ( -
- {member.name - ? member.name - .split(" ") - .map((n: string) => n[0]) - .join("") - .slice(0, 2) - .toUpperCase() - : member.email[0]!.toUpperCase()} -
- )} - - {/* Name + email */} -
-
-

- {member.name ?? member.email} -

- {member.isCurrentUser && ( - You - )} - {member.status === "pending" && ( - - Invited - - )} -
- {member.name && ( -

- {member.email} -

- )} -
- - {/* Role */} -

- {member.role} -

- - {/* Last active */} -

- {formatLastActive(member.lastActiveAt)} -

- - {/* Actions */} - {!member.isCurrentUser ? ( - - - - - - {roles.length > 0 && ( - <> - - - Change role - - - {roles.map((role: RoleData) => ( - - handleChangeRole(member.id, role.slug, role.name) - } - > - {role.name} - {role.slug === member.role && ( - - - - - - )} - - ))} - - - - - )} - handleRemove(member.id, member.name ?? member.email)} - > - Remove member - - - - ) : ( -
- )} -
- ))} -
- ); - }, - })} -
- - -
-
+ ); + }, + })} + ); } -type DomainData = { - id: string; - domain: string; - state: string; - verificationToken?: string; - verificationPrefix?: string; -}; - -type MemberData = { - id: string; - email: string; - name: string | null; - avatarUrl: string | null; - role: string; - status: string; - lastActiveAt: string | null; - isCurrentUser: boolean; -}; - -type RoleData = { - slug: string; - name: string; -}; - function DomainCard({ domain: d, onDelete }: { domain: DomainData; onDelete: () => void }) { const isVerified = d.state === "verified"; const isPending = d.state === "pending"; @@ -610,145 +255,3 @@ function DomainCard({ domain: d, onDelete }: { domain: DomainData; onDelete: () ); } - -function InviteErrorAlert({ cause }: { cause: Cause.Cause }) { - const failure = Cause.findError(cause); - const error = Result.isSuccess(failure) ? failure.success : null; - - if (error instanceof Forbidden) { - return ( -
-

- You've reached your member limit. Upgrade to Team to invite more. -

- - - -
- ); - } - - return ( -
-

Failed to send invitation. Please try again.

-
- ); -} - -function InviteDialog(props: { - open: boolean; - onOpenChange: (v: boolean) => void; - roles: readonly { slug: string; name: string }[]; -}) { - const [state, dispatch] = useReducer(inviteReducer, initialInviteState); - const doInvite = useAtomSet(inviteMember, { mode: "promiseExit" }); - - const handleInvite = async () => { - if (!state.email.trim()) return; - dispatch({ type: "send" }); - - const exit = await doInvite({ - payload: { - email: state.email.trim(), - ...(state.roleSlug ? { roleSlug: state.roleSlug } : {}), - }, - reactivityKeys: orgMemberWriteKeys, - }); - - if (Exit.isSuccess(exit)) { - toast.success(`Invitation sent to ${state.email.trim()}`); - dispatch({ type: "reset" }); - props.onOpenChange(false); - return; - } - dispatch({ type: "error", cause: exit.cause }); - }; - - return ( - { - if (!v) dispatch({ type: "reset" }); - props.onOpenChange(v); - }} - > - - - Invite member - - Send an email invitation to join your organization. - - - -
-
- - - dispatch({ type: "setEmail", email: (e.target as HTMLInputElement).value }) - } - onKeyDown={(e) => { - if (e.key === "Enter") handleInvite(); - }} - className="text-sm h-9" - /> -
- - {props.roles.length > 0 && ( -
- - -
- )} - - {state.status === "error" && state.failure && } -
- - - - - - - - - - ); -} diff --git a/apps/cloud/src/secrets-isolation.e2e.node.test.ts b/apps/cloud/src/secrets-isolation.e2e.node.test.ts index 8bb48326e..d862f3ace 100644 --- a/apps/cloud/src/secrets-isolation.e2e.node.test.ts +++ b/apps/cloud/src/secrets-isolation.e2e.node.test.ts @@ -73,15 +73,15 @@ describe("cloud secret isolation (HTTP, user-org scope stack)", () => { it.effect("users in same org cannot read each other's user-scoped secrets", () => Effect.gen(function* () { - const orgId = nextOrgId(); + const organizationId = nextOrgId(); const aliceId = nextUserId(); const bobId = nextUserId(); const id = `sec_${uniq()}`; // Alice writes at her per-user scope — where OAuth tokens land. - yield* asUser(aliceId, orgId, (client) => + yield* asUser(aliceId, organizationId, (client) => client.secrets.set({ - params: { scopeId: ScopeId.make(testUserOrgScopeId(aliceId, orgId)) }, + params: { scopeId: ScopeId.make(testUserOrgScopeId(aliceId, organizationId)) }, payload: { id: SecretId.make(id), name: "Alice's token", @@ -92,17 +92,17 @@ describe("cloud secret isolation (HTTP, user-org scope stack)", () => { // Bob is in the same org — his user-org scope differs. He should // not see the token in a list. - const bobList = yield* asUser(bobId, orgId, (client) => + const bobList = yield* asUser(bobId, organizationId, (client) => client.secrets.list({ - params: { scopeId: ScopeId.make(testUserOrgScopeId(bobId, orgId)) }, + params: { scopeId: ScopeId.make(testUserOrgScopeId(bobId, organizationId)) }, }), ); expect(bobList.map((s) => s.id)).not.toContain(id); - const bobStatus = yield* asUser(bobId, orgId, (client) => + const bobStatus = yield* asUser(bobId, organizationId, (client) => client.secrets.status({ params: { - scopeId: ScopeId.make(testUserOrgScopeId(bobId, orgId)), + scopeId: ScopeId.make(testUserOrgScopeId(bobId, organizationId)), secretId: SecretId.make(id), }, }), @@ -110,10 +110,10 @@ describe("cloud secret isolation (HTTP, user-org scope stack)", () => { expect(bobStatus.status).toBe("missing"); // And Alice still sees her own token metadata. - const aliceStatus = yield* asUser(aliceId, orgId, (client) => + const aliceStatus = yield* asUser(aliceId, organizationId, (client) => client.secrets.status({ params: { - scopeId: ScopeId.make(testUserOrgScopeId(aliceId, orgId)), + scopeId: ScopeId.make(testUserOrgScopeId(aliceId, organizationId)), secretId: SecretId.make(id), }, }), @@ -124,14 +124,14 @@ describe("cloud secret isolation (HTTP, user-org scope stack)", () => { it.effect("org-scoped secrets are visible to every user in that org", () => Effect.gen(function* () { - const orgId = nextOrgId(); + const organizationId = nextOrgId(); const adminId = nextUserId(); const memberId = nextUserId(); const id = `sec_${uniq()}`; - yield* asUser(adminId, orgId, (client) => + yield* asUser(adminId, organizationId, (client) => client.secrets.set({ - params: { scopeId: ScopeId.make(orgId) }, + params: { scopeId: ScopeId.make(organizationId) }, payload: { id: SecretId.make(id), name: "Org API Key", @@ -140,14 +140,14 @@ describe("cloud secret isolation (HTTP, user-org scope stack)", () => { }), ); - const adminStatus = yield* asUser(adminId, orgId, (client) => + const adminStatus = yield* asUser(adminId, organizationId, (client) => client.secrets.status({ - params: { scopeId: ScopeId.make(orgId), secretId: SecretId.make(id) }, + params: { scopeId: ScopeId.make(organizationId), secretId: SecretId.make(id) }, }), ); - const memberStatus = yield* asUser(memberId, orgId, (client) => + const memberStatus = yield* asUser(memberId, organizationId, (client) => client.secrets.status({ - params: { scopeId: ScopeId.make(orgId), secretId: SecretId.make(id) }, + params: { scopeId: ScopeId.make(organizationId), secretId: SecretId.make(id) }, }), ); expect(adminStatus.status).toBe("resolved"); @@ -209,11 +209,11 @@ describe("cloud secret isolation (HTTP, user-org scope stack)", () => { it.effect("secrets.set rejects a scope outside the executor's stack", () => Effect.gen(function* () { - const orgId = nextOrgId(); + const organizationId = nextOrgId(); const userId = nextUserId(); const foreignOrg = nextOrgId(); - const result = yield* asUser(userId, orgId, (client) => + const result = yield* asUser(userId, organizationId, (client) => client.secrets .set({ params: { scopeId: ScopeId.make(foreignOrg) }, diff --git a/apps/cloud/src/server.ts b/apps/cloud/src/server.ts index 0ca7bcd6a..02484a356 100644 --- a/apps/cloud/src/server.ts +++ b/apps/cloud/src/server.ts @@ -9,7 +9,7 @@ import { import * as Sentry from "@sentry/cloudflare"; import handler from "@tanstack/react-start/server-entry"; -import { McpSessionDO as McpSessionDOBase } from "./mcp-session"; +import { McpSessionDO as McpSessionDOBase } from "./mcp/session-durable-object"; import { flushTracerProvider, installTracerProvider } from "./services/telemetry"; // --------------------------------------------------------------------------- diff --git a/apps/cloud/src/services/__test-harness__/api-harness.ts b/apps/cloud/src/services/__test-harness__/api-harness.ts index 213d6abf5..a007f5720 100644 --- a/apps/cloud/src/services/__test-harness__/api-harness.ts +++ b/apps/cloud/src/services/__test-harness__/api-harness.ts @@ -9,7 +9,7 @@ // - `workos-vault` is configured with an in-memory `WorkOSVaultClient` // so secret writes never reach WorkOS's real API. // -// Tests get a `fetchForOrg(orgId)` they can hand to `FetchHttpClient` +// Tests get a `fetchForOrg(organizationId)` they can hand to `FetchHttpClient` // and then call `HttpApiClient.make(ProtectedCloudApi)` against it. // Each test picks its own org id (usually a random UUID) so rows don't // collide across tests. @@ -21,21 +21,19 @@ import { FetchHttpClient, HttpRouter, HttpServer, HttpServerRequest } from "effe import { ExecutionEngineService, ExecutorService, + collectTables, providePluginExtensions, type PluginExtensionServices, } from "@executor-js/api/server"; import { createExecutionEngine } from "@executor-js/execution"; import { makeQuickJsExecutor } from "@executor-js/runtime-quickjs"; -import { Scope, ScopeId, collectTables, createExecutor } from "@executor-js/sdk"; +import { createExecutor, makeUserOrgScopeStack, userOrgScopeId } from "@executor-js/sdk"; import { makeTestWorkOSVaultClient } from "@executor-js/plugin-workos-vault/testing"; import executorConfig from "../../../executor.config"; -import { AuthContext } from "../../auth/middleware"; -import { - ProtectedCloudApi, - ProtectedCloudApiHandlers, - RouterConfig, -} from "../../api/protected-layers"; +import { AuthContext, RouterConfigLive } from "@executor-js/api/server"; + +import { ProtectedCloudApi, ProtectedCloudApiHandlers } from "../../api/layers"; import { DbService } from "../db"; import { createDrizzleFumaDb } from "../fuma"; @@ -43,16 +41,11 @@ export const TEST_BASE_URL = "http://test.local"; export const TEST_ORG_HEADER = "x-test-org-id"; export const TEST_USER_HEADER = "x-test-user-id"; -// Mirrors apps/cloud/src/services/executor.ts#createScopedExecutor — the -// per-user scope id bakes in the org so the same user id in a different -// org gets a distinct scope row. -const userOrgScopeId = (userId: string, orgId: string) => `user-org:${userId}:${orgId}`; - -// `asOrg(orgId, …)` callers don't care which specific user they are, only +// `asOrg(organizationId, …)` callers don't care which specific user they are, only // that the executor has a valid user-org scope. We give each org a stable // default user so list/get operations at the org scope remain deterministic // across calls within a single test. -const defaultUserFor = (orgId: string) => `default_user_${orgId}`; +const defaultUserFor = (organizationId: string) => `default_user_${organizationId}`; // --------------------------------------------------------------------------- // Executor factory — mirrors apps/cloud/services/executor#createScopedExecutor @@ -66,7 +59,11 @@ const testPlugins = executorConfig.plugins({ }); const testHttpClientLayer = FetchHttpClient.layer; -const createTestScopedExecutor = (userId: string, orgId: string, orgName: string) => +const createTestScopedExecutor = ( + userId: string, + organizationId: string, + organizationName: string, +) => Effect.gen(function* () { const { db } = yield* DbService; const plugins = testPlugins; @@ -76,18 +73,9 @@ const createTestScopedExecutor = (userId: string, orgId: string, orgName: string namespace: "executor_cloud", provider: "postgresql", }); - const orgScope = Scope.make({ - id: ScopeId.make(orgId), - name: orgName, - createdAt: new Date(), - }); - const userOrgScope = Scope.make({ - id: ScopeId.make(userOrgScopeId(userId, orgId)), - name: `Personal · ${orgName}`, - createdAt: new Date(), - }); + const scopes = makeUserOrgScopeStack(userId, organizationId, organizationName); return yield* createExecutor({ - scopes: [userOrgScope, orgScope], + scopes, db: fuma.db, plugins, httpClientLayer: testHttpClientLayer, @@ -121,8 +109,8 @@ const TestExecutionStackMiddleware = HttpRouter.middleware<{ return (httpEffect) => Effect.gen(function* () { const request = yield* HttpServerRequest.HttpServerRequest; - const orgId = request.headers[TEST_ORG_HEADER]; - if (!orgId || typeof orgId !== "string") { + const organizationId = request.headers[TEST_ORG_HEADER]; + if (!organizationId || typeof organizationId !== "string") { // oxlint-disable-next-line executor/no-effect-escape-hatch, executor/no-error-constructor -- boundary: test HTTP harness has no request context without x-test-org-id return yield* Effect.die(new Error("missing x-test-org-id")); } @@ -130,9 +118,9 @@ const TestExecutionStackMiddleware = HttpRouter.middleware<{ const userId = typeof userHeader === "string" && userHeader.length > 0 ? userHeader - : defaultUserFor(orgId); - const orgName = `Org ${orgId}`; - const executor = yield* createTestScopedExecutor(userId, orgId, orgName); + : defaultUserFor(organizationId); + const organizationName = `Org ${organizationId}`; + const executor = yield* createTestScopedExecutor(userId, organizationId, organizationName); const engine = createExecutionEngine({ executor, codeExecutor: makeQuickJsExecutor(), @@ -142,10 +130,11 @@ const TestExecutionStackMiddleware = HttpRouter.middleware<{ AuthContext, AuthContext.of({ accountId: userId, - organizationId: orgId, + organizationId, email: "test@example.com", name: "Test User", avatarUrl: null, + roles: [], }), ), Effect.provideService(ExecutorService, executor), @@ -160,43 +149,43 @@ const TestApiLive = HttpApiBuilder.layer(ProtectedCloudApi).pipe( Layer.provide(ProtectedCloudApiHandlers), Layer.provide(TestExecutionStackMiddleware), Layer.provideMerge(HttpApiSwagger.layer(ProtectedCloudApi, { path: "/docs" })), - Layer.provideMerge(RouterConfig), + Layer.provideMerge(RouterConfigLive), Layer.provideMerge(DbService.Live), Layer.provideMerge(HttpServer.layerServices), ); const handler = HttpRouter.toWebHandler(TestApiLive, { disableLogger: true }).handler; -export const fetchForOrg = (orgId: string): typeof globalThis.fetch => +export const fetchForOrg = (organizationId: string): typeof globalThis.fetch => ((input: RequestInfo | URL, init?: RequestInit) => { const base = input instanceof Request ? input : new Request(input, init); const req = new Request(base, { - headers: { ...Object.fromEntries(base.headers), [TEST_ORG_HEADER]: orgId }, + headers: { ...Object.fromEntries(base.headers), [TEST_ORG_HEADER]: organizationId }, }); return handler(req); }) as typeof globalThis.fetch; -export const fetchForUser = (userId: string, orgId: string): typeof globalThis.fetch => +export const fetchForUser = (userId: string, organizationId: string): typeof globalThis.fetch => ((input: RequestInfo | URL, init?: RequestInit) => { const base = input instanceof Request ? input : new Request(input, init); const req = new Request(base, { headers: { ...Object.fromEntries(base.headers), - [TEST_ORG_HEADER]: orgId, + [TEST_ORG_HEADER]: organizationId, [TEST_USER_HEADER]: userId, }, }); return handler(req); }) as typeof globalThis.fetch; -export const clientLayerForOrg = (orgId: string) => +export const clientLayerForOrg = (organizationId: string) => FetchHttpClient.layer.pipe( - Layer.provide(Layer.succeed(FetchHttpClient.Fetch)(fetchForOrg(orgId))), + Layer.provide(Layer.succeed(FetchHttpClient.Fetch)(fetchForOrg(organizationId))), ); -export const clientLayerForUser = (userId: string, orgId: string) => +export const clientLayerForUser = (userId: string, organizationId: string) => FetchHttpClient.layer.pipe( - Layer.provide(Layer.succeed(FetchHttpClient.Fetch)(fetchForUser(userId, orgId))), + Layer.provide(Layer.succeed(FetchHttpClient.Fetch)(fetchForUser(userId, organizationId))), ); // Constructs an HttpApiClient bound to the given org, hands it to `body`, @@ -205,31 +194,32 @@ export const clientLayerForUser = (userId: string, orgId: string) => type ApiShape = HttpApiClient.ForApi; export const asOrg = ( - orgId: string, + organizationId: string, body: (client: ApiShape) => Effect.Effect, ): Effect.Effect => Effect.gen(function* () { const client = yield* HttpApiClient.make(ProtectedCloudApi, { baseUrl: TEST_BASE_URL }); return yield* body(client); - }).pipe(Effect.provide(clientLayerForOrg(orgId))) as Effect.Effect; + }).pipe(Effect.provide(clientLayerForOrg(organizationId))) as Effect.Effect; // Same as `asOrg` but also threads a specific user id through the fake // OrgAuth, so the built executor's user-org scope id is -// `user-org:${userId}:${orgId}`. Use this for tests that care about +// `user-org:${userId}:${organizationId}`. Use this for tests that care about // per-user isolation inside the same org. export const asUser = ( userId: string, - orgId: string, + organizationId: string, body: (client: ApiShape) => Effect.Effect, ): Effect.Effect => Effect.gen(function* () { const client = yield* HttpApiClient.make(ProtectedCloudApi, { baseUrl: TEST_BASE_URL }); return yield* body(client); - }).pipe(Effect.provide(clientLayerForUser(userId, orgId))) as Effect.Effect; + }).pipe(Effect.provide(clientLayerForUser(userId, organizationId))) as Effect.Effect; // Exposed so tests can build the same user-org scope id the harness uses // when writing at a specific user's scope. -export const testUserOrgScopeId = (userId: string, orgId: string) => userOrgScopeId(userId, orgId); +export const testUserOrgScopeId = (userId: string, organizationId: string) => + userOrgScopeId(userId, organizationId); // Re-exports so call sites don't need a second import. export { ProtectedCloudApi }; diff --git a/apps/cloud/src/services/autumn-plans.ts b/apps/cloud/src/services/autumn-plans.ts index 9e112a945..750b61b13 100644 --- a/apps/cloud/src/services/autumn-plans.ts +++ b/apps/cloud/src/services/autumn-plans.ts @@ -3,3 +3,77 @@ import { enterprise, team } from "../../autumn.config"; export const PAID_AUTUMN_PLAN_IDS = new Set([team.id, enterprise.id]); export const ACTIVE_AUTUMN_SUBSCRIPTION_STATUSES = new Set(["active", "trialing"]); + +// --------------------------------------------------------------------------- +// Free-tier organization-creation limit — the createOrganization gate. +// +// These predicates read the Autumn plan config above, so they live with the +// billing config (NOT in `auth/organization.ts`, which the billing-free MCP +// session DO bundle reaches). Used only by `auth/handlers.ts`'s +// `createOrganization` handler. +// --------------------------------------------------------------------------- + +export const FREE_ORGANIZATIONS_PER_USER_LIMIT = 3; + +export type OrganizationLimitSubscriptionSummary = { + readonly planId?: string | null; + readonly status?: string | null; +}; + +export type OrganizationLimitMembershipSummary = { + readonly organizationId: string; + readonly status?: string | null; +}; + +export const isPaidOrganizationSubscription = ( + subscription: OrganizationLimitSubscriptionSummary, +): boolean => + subscription.planId != null && + PAID_AUTUMN_PLAN_IDS.has(subscription.planId) && + ACTIVE_AUTUMN_SUBSCRIPTION_STATUSES.has(subscription.status ?? ""); + +export const hasPaidOrganizationSubscription = ( + subscriptions: ReadonlyArray, +): boolean => subscriptions.some(isPaidOrganizationSubscription); + +export const shouldApplyFreeOrganizationLimit = ( + activeMemberships: ReadonlyArray, + paidOrganizationIds: ReadonlySet, +): boolean => + !activeMemberships.some((membership) => paidOrganizationIds.has(membership.organizationId)); + +export const isOverFreeOrganizationLimit = ( + activeMemberships: ReadonlyArray, +): boolean => activeMemberships.length >= FREE_ORGANIZATIONS_PER_USER_LIMIT; + +// --------------------------------------------------------------------------- +// Per-plan member seat limits — the org member seat-gate (reserveMemberSlot). +// Reads the same Autumn plan config. Used by the account provider seat-gate. +// --------------------------------------------------------------------------- + +const MEMBER_LIMITS: Record = { + free: 3, + "free-pay-as-you-go": 3, + team: null, + enterprise: null, +}; + +export const DEFAULT_MEMBER_LIMIT = 3; + +export type AutumnSubscriptionSummary = { + readonly planId?: string | null; + readonly status?: string | null; +}; + +export const selectActiveMemberLimitPlan = ( + subscriptions: ReadonlyArray, +): string => { + const active = + subscriptions.find((subscription) => + ACTIVE_AUTUMN_SUBSCRIPTION_STATUSES.has(subscription.status ?? ""), + ) ?? subscriptions[0]; + return active?.planId ?? "free"; +}; + +export const getMemberLimitForPlan = (planId: string): number | null => + planId in MEMBER_LIMITS ? MEMBER_LIMITS[planId] : DEFAULT_MEMBER_LIMIT; diff --git a/apps/cloud/src/services/db.test.ts b/apps/cloud/src/services/db.test.ts index e32c8d2e9..3ef41f35f 100644 --- a/apps/cloud/src/services/db.test.ts +++ b/apps/cloud/src/services/db.test.ts @@ -86,14 +86,14 @@ describe("DbService", () => { it("supports nested scopes within a single outer scope (regression: /api/scope pattern)", async () => { // Mirrors api.ts: an outer scope resolves the org, then an inner scope // (the HttpApi request handler) re-acquires DbService and queries again. - const orgId = `org_${crypto.randomUUID()}`; + const organizationId = `org_${crypto.randomUUID()}`; const outer = Layer.provide( Layer.effectDiscard( Effect.gen(function* () { const { db } = yield* DbService; yield* Effect.promise(() => - makeUserStore(db).upsertOrganization({ id: orgId, name: "Acme" }), + makeUserStore(db).upsertOrganization({ id: organizationId, name: "Acme" }), ); }), ), @@ -108,13 +108,13 @@ describe("DbService", () => { return yield* Effect.scoped( Effect.gen(function* () { const { db } = yield* DbService; - return yield* Effect.promise(() => makeUserStore(db).getOrganization(orgId)); + return yield* Effect.promise(() => makeUserStore(db).getOrganization(organizationId)); }).pipe(Effect.provide(DbService.Live)), ) as Effect.Effect<{ id: string; name: string } | null, never, never>; }) as Effect.Effect<{ id: string; name: string } | null, never, never>, ); - expect(result?.id).toBe(orgId); + expect(result?.id).toBe(organizationId); expect(result?.name).toBe("Acme"); }, 15_000); }); diff --git a/apps/cloud/src/services/execution-stack.ts b/apps/cloud/src/services/execution-stack.ts index d901416c1..03bed7414 100644 --- a/apps/cloud/src/services/execution-stack.ts +++ b/apps/cloud/src/services/execution-stack.ts @@ -1,34 +1,118 @@ // --------------------------------------------------------------------------- -// Shared execution stack — the wiring that turns an organization into a -// runnable executor + engine. Used by the protected HTTP API (per-request) -// and the MCP session DO (per-session) so changes to the stack flow to both. +// Cloud execution-stack seams. +// +// The shared `makeExecutionStack` (@executor-js/api/server) owns the body: +// makeScopedExecutor -> createExecutionEngine -> EngineDecorator.decorate. +// Used by the protected HTTP API (per-request) and the MCP session DO +// (per-session) so changes to the stack flow to both. Cloud supplies the five +// seam Layers it reads from; the only cloud-specific differences are the +// Cloudflare dynamic-worker code substrate and the usage-metering decorator. +// +// - DbProvider -> cloudDbProviderLayer: rebuilds the postgres-js fuma +// client per request off the request-scoped +// `DbService.db` (Hyperdrive forbids sharing an I/O +// handle across requests). The shared factory reads +// `db` without caching, preserving per-request rebuild. +// - PluginsProvider -> fresh per-request plugins with the Worker env's +// WorkOS credentials. +// - HostConfig -> `allowLocalNetwork` is config-driven (the +// `ALLOW_LOCAL_NETWORK` var; production leaves it unset +// -> `false`, the test workers set it `"true"`). It is +// an SSRF/private-network guard, so it MUST NOT key off +// a test flag. `webBaseUrl` is `VITE_PUBLIC_SITE_URL ?? +// executor.sh`. +// - CodeExecutorProvider -> `makeDynamicWorkerExecutor({ loader: env.LOADER })`. +// - EngineDecorator -> the BASE stack uses the no-op decorator (the MCP +// session DO never meters); the METERED stack (HTTP +// executor plane only) overrides it with the billing +// decorator (`CloudMeteredExecutionStackLayer`, +// ../api/execution-stack-metered.ts). Billing lives in +// the cloud app, not this neutral stack. // --------------------------------------------------------------------------- import { env } from "cloudflare:workers"; -import { Effect } from "effect"; +import { Layer } from "effect"; -import { createExecutionEngine } from "@executor-js/execution"; +import { + CodeExecutorProvider, + DbProvider, + EngineDecorator, + EngineDecoratorNoop, + HostConfig, + PluginsProvider, + collectTables, +} from "@executor-js/api/server"; import { makeDynamicWorkerExecutor } from "@executor-js/runtime-dynamic-worker"; -import { withExecutionUsageTracking } from "../api/execution-usage"; -import { AutumnService } from "./autumn"; -import { createScopedExecutor } from "./executor"; - -export const makeExecutionStack = ( - userId: string, - organizationId: string, - organizationName: string, -) => - Effect.gen(function* () { - const executor = yield* createScopedExecutor(userId, organizationId, organizationName).pipe( - Effect.withSpan("McpSessionDO.createScopedExecutor"), - ); - const codeExecutor = makeDynamicWorkerExecutor({ loader: env.LOADER }); - const autumn = yield* AutumnService; - const engine = withExecutionUsageTracking( - organizationId, - createExecutionEngine({ executor, codeExecutor }), - (orgId) => Effect.runFork(autumn.trackExecution(orgId)), - ); - return { executor, engine }; - }).pipe(Effect.withSpan("McpSessionDO.makeExecutionStack")); +import executorConfig from "../../executor.config"; +import { cloudPlugins } from "../api/cloud-plugins"; +import { DbService } from "./db"; +import { cloudDbProviderLayer } from "./fuma"; + +export { makeExecutionStack } from "@executor-js/api/server"; + +// The plugin table set is stable (derived from the static `cloudPlugins` tuple), +// so the per-request DbProvider rebuilds the fuma client over the same schema. +export const CloudDbProvider = cloudDbProviderLayer(collectTables(cloudPlugins)); + +// Fresh plugin instances per request, carrying the Worker env's WorkOS Vault +// credentials. Matches the old `createScopedExecutor`'s `orgPlugins()`. +export const CloudPluginsProvider: Layer.Layer = Layer.succeed(PluginsProvider)({ + plugins: () => + executorConfig.plugins({ + workosCredentials: { + apiKey: env.WORKOS_API_KEY, + clientId: env.WORKOS_CLIENT_ID, + }, + }), +}); + +export const CloudHostConfig: Layer.Layer = Layer.sync(HostConfig, () => ({ + // SSRF / private-network egress guard. Config-driven, NOT a test flag: + // production leaves `ALLOW_LOCAL_NETWORK` unset so the guard stays ON (`false`); + // the test workers (`wrangler.test.jsonc` / `wrangler.miniflare.jsonc`) opt in + // with `"true"` so fixtures can reach localhost. See `hosted-http-client.ts`. + allowLocalNetwork: env.ALLOW_LOCAL_NETWORK === "true", + webBaseUrl: env.VITE_PUBLIC_SITE_URL ?? "https://executor.sh", +})); + +export const CloudCodeExecutorProvider: Layer.Layer = Layer.sync( + CodeExecutorProvider, + () => makeDynamicWorkerExecutor({ loader: env.LOADER }), +); + +/** + * The four billing-free execution-stack seams (db / plugins / host-config / + * code-executor) — everything `makeExecutionStack` reads EXCEPT the + * `EngineDecorator`. The metered HTTP plane composes this with the billing + * decorator (../api/execution-stack-metered.ts); the neutral stack below adds + * the no-op decorator. Exported so the metered overlay builds over the SAME four + * seams rather than relying on a layer override. + */ +export const CloudExecutionSeamsLayer: Layer.Layer< + DbProvider | PluginsProvider | HostConfig | CodeExecutorProvider, + never, + DbService +> = Layer.mergeAll( + CloudDbProvider, + CloudPluginsProvider, + CloudHostConfig, + CloudCodeExecutorProvider, +); + +/** + * The five execution-stack seams the shared `makeExecutionStack` reads from, + * with the NO-OP engine decorator. This is the neutral stack: it requires only + * `DbService` (per-request Hyperdrive db) and carries NO billing dependency, so + * the MCP session DO — which never meters — can build an engine without dragging + * in any billing service. + * + * The HTTP executor plane (the only path that meters) uses + * `CloudMeteredExecutionStackLayer` (../api/execution-stack-metered.ts), which + * swaps the no-op decorator for the billing one. + */ +export const CloudExecutionStackLayer: Layer.Layer< + DbProvider | PluginsProvider | HostConfig | CodeExecutorProvider | EngineDecorator, + never, + DbService +> = Layer.merge(CloudExecutionSeamsLayer, EngineDecoratorNoop); diff --git a/apps/cloud/src/services/executor.ts b/apps/cloud/src/services/executor.ts deleted file mode 100644 index 049ea1444..000000000 --- a/apps/cloud/src/services/executor.ts +++ /dev/null @@ -1,102 +0,0 @@ -// --------------------------------------------------------------------------- -// Cloud executor — stateless, per-request, new SDK shape -// --------------------------------------------------------------------------- -// -// Each invocation of `createScopedExecutor` runs inside a request-scoped -// Effect and yields a fresh executor bound to the current DbService's -// per-request postgres.js client. Cloudflare Workers + Hyperdrive demand -// fresh connections per request, so "build once" means "once per request" -// here. - -import { Effect } from "effect"; - -import { - Scope, - ScopeId, - collectTables, - createExecutor, - makeHostedHttpClientLayer, -} from "@executor-js/sdk"; - -import { env } from "cloudflare:workers"; -import executorConfig from "../../executor.config"; -import { DbService } from "./db"; -import { createDrizzleFumaDb } from "./fuma"; - -// --------------------------------------------------------------------------- -// Plugin list lives in `executor.config.ts` — that file is the single source -// of truth for runtime, schema wiring, and the test harness. Per-request -// runtime values (WorkOS credentials from the Worker env) are passed through -// the factory's `deps` parameter. -// --------------------------------------------------------------------------- - -export type CloudPlugins = ReturnType; - -const orgPlugins = (): CloudPlugins => - executorConfig.plugins({ - workosCredentials: { - apiKey: env.WORKOS_API_KEY, - clientId: env.WORKOS_CLIENT_ID, - }, - }); - -// --------------------------------------------------------------------------- -// Create a fresh executor for a (user, org) pair (stateless, per-request). -// -// Scope stack is `[userOrgScope, orgScope]` — innermost first. The -// user-within-org scope id (`user-org:${userId}:${orgId}`) intentionally -// includes the org id so the same WorkOS user in a different org gets a -// distinct scope row; future workspace scopes can slot in between without -// conflicting with a hypothetical global user scope. -// -// OAuth token writes require an explicit `tokenScope`. User sign-in UI passes -// the user-org scope so a member's access/refresh tokens cannot leak to other -// members via `secrets.list`, while source rows and org-wide credentials live -// on the outer scope. -// --------------------------------------------------------------------------- - -export const createScopedExecutor = ( - userId: string, - organizationId: string, - organizationName: string, -) => - Effect.gen(function* () { - const { db } = yield* DbService; - - const plugins = orgPlugins(); - const httpClientLayer = makeHostedHttpClientLayer({ - allowLocalNetwork: env.NODE_ENV === "test", - }); - const fuma = createDrizzleFumaDb({ - db, - tables: collectTables(plugins), - namespace: "executor_cloud", - provider: "postgresql", - }); - - const orgScope = Scope.make({ - id: ScopeId.make(organizationId), - name: organizationName, - createdAt: new Date(), - }); - const userOrgScope = Scope.make({ - id: ScopeId.make(`user-org:${userId}:${organizationId}`), - name: `Personal · ${organizationName}`, - createdAt: new Date(), - }); - - // The executor surface returns raw `StorageFailure`; translation to - // the opaque `InternalError({ traceId })` happens at the HTTP edge - // via `withCapture` (see `api/protected-layers.ts`). That's - // where `ErrorCaptureLive` (Sentry) gets wired in. - return yield* createExecutor({ - scopes: [userOrgScope, orgScope], - db: fuma.db, - plugins, - httpClientLayer, - onElicitation: "accept-all", - coreTools: { - webBaseUrl: env.VITE_PUBLIC_SITE_URL ?? "https://executor.sh", - }, - }); - }); diff --git a/apps/cloud/src/services/fuma.ts b/apps/cloud/src/services/fuma.ts index 8753dcfbd..e780a2b63 100644 --- a/apps/cloud/src/services/fuma.ts +++ b/apps/cloud/src/services/fuma.ts @@ -1,9 +1,18 @@ -import { fumadb, type FumaDB } from "fumadb"; -import { drizzleAdapter, type DrizzleConfig } from "fumadb/adapters/drizzle"; -import { schema as fumaSchema, type RelationsMap } from "fumadb/schema"; +import { Effect, Layer } from "effect"; +import { type FumaDB } from "fumadb"; +import { type DrizzleConfig } from "fumadb/adapters/drizzle"; +import { type schema as fumaSchema, type RelationsMap } from "fumadb/schema"; +import { + createExecutorFumaDb, + DbProvider, + type ExecutorDbHandle, + type ExecutorDbProvider, +} from "@executor-js/api/server"; import type { FumaDb, FumaTables } from "@executor-js/sdk"; +import { DbService } from "./db"; + type DrizzleFumaSchema = ReturnType< typeof fumaSchema> >; @@ -18,30 +27,45 @@ export interface CreateDrizzleFumaDbOptions( options: CreateDrizzleFumaDbOptions, -): DrizzleFumaDb => { - const version = options.version ?? "1.0.0"; - const latestSchema = fumaSchema({ - version, +): DrizzleFumaDb => + createExecutorFumaDb(options.db, { tables: options.tables, - }); - const factory = fumadb({ namespace: options.namespace, - schemas: [latestSchema], + version: options.version ?? "1.0.0", + provider: options.provider, }); - const fuma = factory.client( - drizzleAdapter({ - db: options.db, - provider: options.provider, + +export const CLOUD_NAMESPACE = "executor_cloud"; + +// Shared DbProvider seam (P2a). Cloud opens a fresh postgres-js connection per +// request (Cloudflare forbids sharing I/O across handlers); this assembles the +// FumaDB handle over the request-scoped `DbService.db`. Migrations run +// out-of-band, so there is no schema bring-up here, and `close` is a no-op — +// `DbService.Live` owns the postgres connection lifecycle. +export const cloudDbProviderLayer = ( + tables: FumaTables, +): Layer.Layer => + Layer.effect(DbProvider)( + Effect.map(DbService.asEffect(), ({ db }): ExecutorDbHandle => { + const fuma = createDrizzleFumaDb({ + db, + tables, + namespace: CLOUD_NAMESPACE, + provider: "postgresql", + }); + return { + db: fuma.db, + fuma: fuma.fuma, + close: async () => {}, + }; }), ); - - return { - db: fuma.orm(version), - fuma, - }; -}; diff --git a/apps/cloud/src/services/mcp-oauth.node.test.ts b/apps/cloud/src/services/mcp-oauth.node.test.ts index 14fd67468..bc873c889 100644 --- a/apps/cloud/src/services/mcp-oauth.node.test.ts +++ b/apps/cloud/src/services/mcp-oauth.node.test.ts @@ -109,14 +109,14 @@ describe("mcp oauth end-to-end (node pool, real OAuth + MCP server)", () => { Effect.scoped( Effect.gen(function* () { const oauth = yield* serveOAuthTestServer(); - const orgId = `org_${crypto.randomUUID()}`; + const organizationId = `org_${crypto.randomUUID()}`; const userId = `user_${crypto.randomUUID()}`; - const userScope = ScopeId.make(testUserOrgScopeId(userId, orgId)); + const userScope = ScopeId.make(testUserOrgScopeId(userId, organizationId)); const namespace = `ns_${crypto.randomUUID().slice(0, 8)}`; const connectionId = `mcp-oauth2-${namespace}`; const redirectUrl = "http://test.local/api/mcp/oauth/callback"; - const started = yield* asUser(userId, orgId, (client) => + const started = yield* asUser(userId, organizationId, (client) => client.oauth.start({ params: { scopeId: userScope }, payload: { @@ -137,7 +137,7 @@ describe("mcp oauth end-to-end (node pool, real OAuth + MCP server)", () => { }); expect(state).toBe(started.sessionId); - const completed = yield* asUser(userId, orgId, (client) => + const completed = yield* asUser(userId, organizationId, (client) => client.oauth.complete({ params: { scopeId: userScope }, payload: { state, code }, @@ -155,11 +155,11 @@ describe("mcp oauth end-to-end (node pool, real OAuth + MCP server)", () => { Effect.scoped( Effect.gen(function* () { const oauth = yield* serveOAuthTestServer(); - const orgId = `org_${crypto.randomUUID()}`; + const organizationId = `org_${crypto.randomUUID()}`; const userA = `user_${crypto.randomUUID()}`; const userB = `user_${crypto.randomUUID()}`; - const scopeA = ScopeId.make(testUserOrgScopeId(userA, orgId)); - const scopeB = ScopeId.make(testUserOrgScopeId(userB, orgId)); + const scopeA = ScopeId.make(testUserOrgScopeId(userA, organizationId)); + const scopeB = ScopeId.make(testUserOrgScopeId(userB, organizationId)); const namespace = `ns_${crypto.randomUUID().slice(0, 8)}`; const connectionId = `mcp-oauth2-${namespace}`; const endpoint = oauth.mcpResourceUrl; @@ -168,7 +168,7 @@ describe("mcp oauth end-to-end (node pool, real OAuth + MCP server)", () => { const regsBefore = yield* countRequestsTo(oauth, "/register"); // --- User A: full OAuth round-trip, fresh DCR. --- - const startedA = yield* asUser(userA, orgId, (client) => + const startedA = yield* asUser(userA, organizationId, (client) => client.oauth.start({ params: { scopeId: scopeA }, payload: { @@ -184,7 +184,7 @@ describe("mcp oauth end-to-end (node pool, real OAuth + MCP server)", () => { const redirA = yield* oauth.completeAuthorizationCodeFlow({ authorizationUrl: startedA.authorizationUrl!, }); - const completedA = yield* asUser(userA, orgId, (client) => + const completedA = yield* asUser(userA, organizationId, (client) => client.oauth.complete({ params: { scopeId: scopeA }, payload: { state: redirA.state, code: redirA.code }, @@ -194,7 +194,7 @@ describe("mcp oauth end-to-end (node pool, real OAuth + MCP server)", () => { expect(yield* countRequestsTo(oauth, "/register")).toBe(regsBefore + 1); // --- User B: gets the same logical connection id in a different scope. --- - const startedB = yield* asUser(userB, orgId, (client) => + const startedB = yield* asUser(userB, organizationId, (client) => client.oauth.start({ params: { scopeId: scopeB }, payload: { @@ -210,7 +210,7 @@ describe("mcp oauth end-to-end (node pool, real OAuth + MCP server)", () => { const redirB = yield* oauth.completeAuthorizationCodeFlow({ authorizationUrl: startedB.authorizationUrl!, }); - const completedB = yield* asUser(userB, orgId, (client) => + const completedB = yield* asUser(userB, organizationId, (client) => client.oauth.complete({ params: { scopeId: scopeB }, payload: { state: redirB.state, code: redirB.code }, diff --git a/apps/cloud/src/org/member-limits.node.test.ts b/apps/cloud/src/services/member-limits.node.test.ts similarity index 98% rename from apps/cloud/src/org/member-limits.node.test.ts rename to apps/cloud/src/services/member-limits.node.test.ts index bc027bd17..08ca67e74 100644 --- a/apps/cloud/src/org/member-limits.node.test.ts +++ b/apps/cloud/src/services/member-limits.node.test.ts @@ -1,6 +1,6 @@ import { describe, expect, it } from "@effect/vitest"; -import { getMemberLimitForPlan, selectActiveMemberLimitPlan } from "./member-limits"; +import { getMemberLimitForPlan, selectActiveMemberLimitPlan } from "./autumn-plans"; describe("member limits", () => { it("uses an active or trialing subscription before older entries", () => { diff --git a/apps/cloud/src/auth/organization-limits.node.test.ts b/apps/cloud/src/services/organization-limits.node.test.ts similarity index 98% rename from apps/cloud/src/auth/organization-limits.node.test.ts rename to apps/cloud/src/services/organization-limits.node.test.ts index b80ead2a5..2ae58f25b 100644 --- a/apps/cloud/src/auth/organization-limits.node.test.ts +++ b/apps/cloud/src/services/organization-limits.node.test.ts @@ -5,7 +5,7 @@ import { hasPaidOrganizationSubscription, isOverFreeOrganizationLimit, shouldApplyFreeOrganizationLimit, -} from "./organization-limits"; +} from "./autumn-plans"; describe("organization limits", () => { it("treats active and trialing paid org subscriptions as paid", () => { diff --git a/apps/cloud/src/services/sources-api.node.test.ts b/apps/cloud/src/services/sources-api.node.test.ts index 251271647..24ccfdb06 100644 --- a/apps/cloud/src/services/sources-api.node.test.ts +++ b/apps/cloud/src/services/sources-api.node.test.ts @@ -337,12 +337,12 @@ describe("sources api (HTTP)", () => { Effect.succeed(authorization === "Bearer github-token"), }, }); - const orgId = `org_${crypto.randomUUID()}`; + const organizationId = `org_${crypto.randomUUID()}`; const userId = `user_${crypto.randomUUID()}`; - const userScope = testUserOrgScopeId(userId, orgId); + const userScope = testUserOrgScopeId(userId, organizationId); const namespace = `github_graphql_${crypto.randomUUID().replace(/-/g, "_")}`; - yield* asUser(userId, orgId, (client) => + yield* asUser(userId, organizationId, (client) => client.secrets.set({ params: { scopeId: ScopeId.make(userScope) }, payload: { @@ -353,9 +353,9 @@ describe("sources api (HTTP)", () => { }), ); - const added = yield* asUser(userId, orgId, (client) => + const added = yield* asUser(userId, organizationId, (client) => client.graphql.addSource({ - params: { scopeId: ScopeId.make(orgId) }, + params: { scopeId: ScopeId.make(organizationId) }, payload: { endpoint: server.endpoint, namespace, @@ -548,16 +548,16 @@ describe("sources api (HTTP)", () => { it.effect("per-user source bindings isolate personal credentials over HTTP", () => Effect.gen(function* () { - const orgId = `org_${crypto.randomUUID()}`; + const organizationId = `org_${crypto.randomUUID()}`; const aliceId = `user_${crypto.randomUUID().slice(0, 8)}`; const bobId = `user_${crypto.randomUUID().slice(0, 8)}`; const namespace = `ns_${crypto.randomUUID().replace(/-/g, "_")}`; - const aliceScope = testUserOrgScopeId(aliceId, orgId); - const bobScope = testUserOrgScopeId(bobId, orgId); + const aliceScope = testUserOrgScopeId(aliceId, organizationId); + const bobScope = testUserOrgScopeId(bobId, organizationId); - yield* asOrg(orgId, (client) => + yield* asOrg(organizationId, (client) => client.openapi.addSpec({ - params: { scopeId: ScopeId.make(orgId) }, + params: { scopeId: ScopeId.make(organizationId) }, payload: { ...makeMinimalOpenApiSourcePayload(namespace), headers: { @@ -570,7 +570,7 @@ describe("sources api (HTTP)", () => { }), ); - yield* asUser(aliceId, orgId, (client) => + yield* asUser(aliceId, organizationId, (client) => Effect.gen(function* () { yield* client.secrets.set({ params: { scopeId: ScopeId.make(aliceScope) }, @@ -584,7 +584,7 @@ describe("sources api (HTTP)", () => { params: { scopeId: ScopeId.make(aliceScope) }, payload: { scope: ScopeId.make(aliceScope), - source: { id: namespace, scope: ScopeId.make(orgId) }, + source: { id: namespace, scope: ScopeId.make(organizationId) }, slotKey: "header:authorization", value: { kind: "secret", @@ -594,7 +594,7 @@ describe("sources api (HTTP)", () => { }); expect(binding).toMatchObject({ sourceId: namespace, - sourceScopeId: ScopeId.make(orgId), + sourceScopeId: ScopeId.make(organizationId), scopeId: ScopeId.make(aliceScope), slotKey: "header:authorization", value: { @@ -607,7 +607,7 @@ describe("sources api (HTTP)", () => { }), ); - yield* asUser(bobId, orgId, (client) => + yield* asUser(bobId, organizationId, (client) => Effect.gen(function* () { yield* client.secrets.set({ params: { scopeId: ScopeId.make(bobScope) }, @@ -621,7 +621,7 @@ describe("sources api (HTTP)", () => { params: { scopeId: ScopeId.make(bobScope) }, payload: { scope: ScopeId.make(bobScope), - source: { id: namespace, scope: ScopeId.make(orgId) }, + source: { id: namespace, scope: ScopeId.make(organizationId) }, slotKey: "header:authorization", value: { kind: "secret", @@ -632,12 +632,12 @@ describe("sources api (HTTP)", () => { }), ); - const aliceBindings = yield* asUser(aliceId, orgId, (client) => + const aliceBindings = yield* asUser(aliceId, organizationId, (client) => client.sources.listBindings({ params: { scopeId: ScopeId.make(aliceScope), sourceId: namespace, - sourceScopeId: ScopeId.make(orgId), + sourceScopeId: ScopeId.make(organizationId), }, }), ); @@ -661,12 +661,12 @@ describe("sources api (HTTP)", () => { ), ).toBe(false); - const bobBindings = yield* asUser(bobId, orgId, (client) => + const bobBindings = yield* asUser(bobId, organizationId, (client) => client.sources.listBindings({ params: { scopeId: ScopeId.make(bobScope), sourceId: namespace, - sourceScopeId: ScopeId.make(orgId), + sourceScopeId: ScopeId.make(organizationId), }, }), ); @@ -690,24 +690,26 @@ describe("sources api (HTTP)", () => { ), ).toBe(false); - const sources = yield* asOrg(orgId, (client) => - client.sources.list({ params: { scopeId: ScopeId.make(orgId) } }), + const sources = yield* asOrg(organizationId, (client) => + client.sources.list({ params: { scopeId: ScopeId.make(organizationId) } }), + ); + expect(sources.find((source) => source.id === namespace)?.scopeId).toBe( + ScopeId.make(organizationId), ); - expect(sources.find((source) => source.id === namespace)?.scopeId).toBe(ScopeId.make(orgId)); }), ); it.effect("personal source override picker can see org-owned secrets over HTTP", () => Effect.gen(function* () { - const orgId = `org_${crypto.randomUUID()}`; + const organizationId = `org_${crypto.randomUUID()}`; const aliceId = `user_${crypto.randomUUID().slice(0, 8)}`; const namespace = `ns_${crypto.randomUUID().replace(/-/g, "_")}`; - const aliceScope = testUserOrgScopeId(aliceId, orgId); + const aliceScope = testUserOrgScopeId(aliceId, organizationId); - yield* asOrg(orgId, (client) => + yield* asOrg(organizationId, (client) => Effect.gen(function* () { yield* client.openapi.addSpec({ - params: { scopeId: ScopeId.make(orgId) }, + params: { scopeId: ScopeId.make(organizationId) }, payload: { ...makeMinimalOpenApiSourcePayload(namespace), headers: { @@ -720,7 +722,7 @@ describe("sources api (HTTP)", () => { }); yield* client.secrets.set({ - params: { scopeId: ScopeId.make(orgId) }, + params: { scopeId: ScopeId.make(organizationId) }, payload: { id: SecretId.make("shared_pat"), name: "Shared PAT", @@ -730,7 +732,7 @@ describe("sources api (HTTP)", () => { }), ); - const secrets = yield* asUser(aliceId, orgId, (client) => + const secrets = yield* asUser(aliceId, organizationId, (client) => client.secrets.listAll({ params: { scopeId: ScopeId.make(aliceScope) } }), ); @@ -742,12 +744,12 @@ describe("sources api (HTTP)", () => { })); expect(pickerSecrets).toContainEqual( - expect.objectContaining({ id: "shared_pat", scopeId: orgId }), + expect.objectContaining({ id: "shared_pat", scopeId: organizationId }), ); expect( secretsForCredentialTarget(pickerSecrets, ScopeId.make(aliceScope), [ { id: ScopeId.make(aliceScope) }, - { id: ScopeId.make(orgId) }, + { id: ScopeId.make(organizationId) }, ]).map((secret) => secret.id), ).toContain("shared_pat"); }), diff --git a/apps/cloud/src/services/telemetry.ts b/apps/cloud/src/services/telemetry.ts index facd0efb6..8652d2160 100644 --- a/apps/cloud/src/services/telemetry.ts +++ b/apps/cloud/src/services/telemetry.ts @@ -101,6 +101,6 @@ const makeTelemetryLive = (): Layer.Layer => ), ); -export const TelemetryLive: Layer.Layer = makeTelemetryLive(); +export const WorkerTelemetryLive: Layer.Layer = makeTelemetryLive(); export const DoTelemetryLive: Layer.Layer = makeTelemetryLive(); diff --git a/apps/cloud/src/start.ts b/apps/cloud/src/start.ts index 908438fea..ddf6ed0df 100644 --- a/apps/cloud/src/start.ts +++ b/apps/cloud/src/start.ts @@ -1,155 +1,43 @@ -import { env } from "cloudflare:workers"; import { createMiddleware, createStart } from "@tanstack/react-start"; -import { Effect } from "effect"; -import { handleApiRequest } from "./api"; -import { mcpFetch } from "./mcp"; -import { handleSentryTunnelRequest } from "./sentry-tunnel"; -// --------------------------------------------------------------------------- -// Marketing routes — proxied to the marketing worker via service binding -// --------------------------------------------------------------------------- - -const MARKETING_PATHS = [ - "/home", - "/setup", - "/privacy", - "/terms", - "/api/detect", - "/_astro", - "/og-image.png", - "/pattern-graph-paper.svg", -]; - -const isMarketingPath = (pathname: string) => - MARKETING_PATHS.some((p) => pathname === p || pathname.startsWith(`${p}/`)); - -const getMarketingWorker = () => env.MARKETING as { fetch: typeof fetch } | undefined; - -const marketingMiddleware = createMiddleware({ type: "request" }).server( - async ({ pathname, request, next }) => { - // Only proxy to the marketing worker on the production domain. In local - // dev we don't run `executor-marketing`, so unauthenticated visits fall - // through to the cloud app's routes (which show the sign-in page). - const host = new URL(request.url).hostname; - if (host !== "executor.sh") return next(); - - const shouldProxyToMarketing = - isMarketingPath(pathname) || - (pathname === "/" && !parseCookie(request.headers.get("cookie"), "wos-session")); - - if (!shouldProxyToMarketing) return next(); - - const marketing = getMarketingWorker(); - if (!marketing) return next(); - - const url = new URL(request.url); - // Rewrite /home to / so marketing worker serves its homepage - if (pathname === "/home") { - url.pathname = "/"; - } - return marketing.fetch(new Request(url, request)); - }, -); - -const parseCookie = (cookieHeader: string | null, name: string): string | null => { - if (!cookieHeader) return null; - const match = cookieHeader - .split(";") - .map((v) => v.trim()) - .find((v) => v.startsWith(`${name}=`)); - return match ? match.slice(name.length + 1) || null : null; -}; +import { cloudApiHandler } from "./app"; +import { marketingMiddleware, posthogProxyMiddleware, sentryTunnelMiddleware } from "./edge"; +import { classifyMcpPath } from "./mcp/mount"; // --------------------------------------------------------------------------- -// MCP middleware — routes /mcp and /.well-known/* to the MCP handler +// The unified app web handler — `ExecutorApp.make`'s `toWebHandler` (app.ts). +// It serves EVERY app-owned path in one Effect HTTP layer: the `/api`-prefixed +// typed API (the protected plugin API + account + org + docs + autumn) AND the +// `/mcp` serving envelope + its `/.well-known/*` OAuth discovery docs — exactly +// like self-host's single `toWebHandler`. start.ts no longer hand-routes those +// surfaces; it only decides app-owned-vs-Start and forwards unmodified. // --------------------------------------------------------------------------- -const mcpRequestMiddleware = createMiddleware({ type: "request" }).server( - async ({ pathname, request, next }) => { - if (pathname === "/mcp" || pathname.startsWith("/.well-known/")) { - const response = await mcpFetch(request); - if (response) return response; - } - return next(); - }, -); - -// --------------------------------------------------------------------------- -// Sentry tunnel — the browser SDK POSTs envelopes to /api/sentry-tunnel -// (configured in routes/__root.tsx) to dodge adblockers and CSP. We parse -// the envelope header to recover the DSN, validate against our own, and -// forward the body to Sentry's ingest endpoint. See -// https://docs.sentry.io/platforms/javascript/troubleshooting/#using-the-tunnel-option -// --------------------------------------------------------------------------- +const app = cloudApiHandler(); -const sentryTunnelMiddleware = createMiddleware({ type: "request" }).server( - ({ pathname, request, next }) => { - if (pathname !== "/api/sentry-tunnel" || request.method !== "POST") { - return next(); - } - - const configuredDsn = (env as { SENTRY_DSN?: string }).SENTRY_DSN; - if (!configuredDsn) return new Response(null, { status: 204 }); - - return Effect.runPromise(handleSentryTunnelRequest(request, configuredDsn)); - }, -); - -// --------------------------------------------------------------------------- -// PostHog reverse proxy — the browser SDK targets a build-randomized -// first-party path and we forward to PostHog's ingest + asset hosts. Keeps -// events flowing past adblockers that match *.posthog.com. See -// https://posthog.com/docs/advanced/proxy/cloudflare -// --------------------------------------------------------------------------- - -const POSTHOG_INGEST_HOST = "us.i.posthog.com"; -const POSTHOG_ASSETS_HOST = "us-assets.i.posthog.com"; -const POSTHOG_PROXY_PATH = `/api/${(import.meta.env.VITE_PUBLIC_ANALYTICS_PATH ?? "a").replace( - /^\/+|\/+$/g, - "", -)}`; - -const posthogProxyMiddleware = createMiddleware({ type: "request" }).server( - ({ pathname, request, next }) => { - if (pathname !== POSTHOG_PROXY_PATH && !pathname.startsWith(`${POSTHOG_PROXY_PATH}/`)) { - return next(); - } - - const url = new URL(request.url); - url.hostname = pathname.startsWith(`${POSTHOG_PROXY_PATH}/static/`) - ? POSTHOG_ASSETS_HOST - : POSTHOG_INGEST_HOST; - url.protocol = "https:"; - url.port = ""; - url.pathname = pathname.slice(POSTHOG_PROXY_PATH.length) || "/"; - - const upstream = new Request(url, request); - upstream.headers.delete("cookie"); - return fetch(upstream); - }, -); - -// --------------------------------------------------------------------------- -// API middleware — routes /api/* to the Effect HTTP layer -// --------------------------------------------------------------------------- +// app-owned = the `/api`-prefixed API OR an MCP/OAuth-discovery path. The app +// handler serves these at their real paths (`mountPrefix: "/api"` mounts the +// typed API under `/api`; the MCP envelope mounts `/mcp` + the two discovery +// docs at root), so we forward the request UNMODIFIED — no path stripping. +const isApiPath = (pathname: string) => pathname === "/api" || pathname.startsWith("/api/"); +const isAppOwned = (pathname: string) => isApiPath(pathname) || classifyMcpPath(pathname) !== null; -const apiRequestMiddleware = createMiddleware({ type: "request" }).server( +const appRequestMiddleware = createMiddleware({ type: "request" }).server( ({ pathname, request, next }) => { - if (pathname === "/api" || pathname.startsWith("/api/")) { - const url = new URL(request.url); - url.pathname = url.pathname.replace(/^\/api/, ""); - return handleApiRequest(new Request(url, request)); - } + if (isAppOwned(pathname)) return app.handler(request); return next(); }, ); +// The edge concerns (marketing proxy, sentry tunnel, posthog proxy) live in +// `./edge`; they run before the app's own dispatch. Ordering is load-bearing: +// marketing first (production landing/page proxy), then the analytics tunnels, +// then the unified app plane (api + mcp). export const startInstance = createStart(() => ({ requestMiddleware: [ marketingMiddleware, - mcpRequestMiddleware, sentryTunnelMiddleware, posthogProxyMiddleware, - apiRequestMiddleware, + appRequestMiddleware, ], })); diff --git a/apps/cloud/src/test-bearer.ts b/apps/cloud/src/test-bearer.ts index 1c1e92f0b..41440467b 100644 --- a/apps/cloud/src/test-bearer.ts +++ b/apps/cloud/src/test-bearer.ts @@ -3,7 +3,7 @@ // zero-dependency module so node tests can pull it without dragging in the // worker entry, which imports `cloudflare:workers`. -import type { VerifiedToken } from "./mcp-auth"; +import type { VerifiedToken } from "./mcp/jwt"; export const TEST_BEARER_PREFIX = "test-accept::"; export const NO_ORG_SENTINEL = "none"; diff --git a/apps/cloud/src/test-worker.ts b/apps/cloud/src/test-worker.ts index 34e7403e4..9852fff29 100644 --- a/apps/cloud/src/test-worker.ts +++ b/apps/cloud/src/test-worker.ts @@ -13,7 +13,6 @@ // load — that was SIGSEGV-ing workerd during test instantiation. // --------------------------------------------------------------------------- -import { HttpEffect } from "effect/unstable/http"; import { Effect, Layer } from "effect"; import { drizzle } from "drizzle-orm/postgres-js"; import postgres, { type Sql } from "postgres"; @@ -21,21 +20,21 @@ import postgres, { type Sql } from "postgres"; import { McpAuth, McpAuthLive, + McpJwtVerificationError, McpOrganizationAuth, McpOrganizationAuthLive, - classifyMcpPath, mcpAuthorized, - mcpApp, mcpUnauthorized, -} from "./mcp"; +} from "./mcp/auth"; +import { classifyMcpPath, makeMcpWebHandler } from "./mcp/mount"; +import { cloudMcpAuthProviderLayer } from "./mcp/auth-provider"; import { ApiKeyService } from "./auth/api-keys"; -import { McpJwtVerificationError } from "./mcp-auth"; import { organizations } from "./services/schema"; import { parseTestBearer } from "./test-bearer"; import { DoTelemetryLive } from "./services/telemetry"; import { CoreSharedServices } from "./api/core-shared-services"; -export { McpSessionDO } from "./mcp-session"; +export { McpSessionDO } from "./mcp/session-durable-object"; const TestMcpAuthLive = Layer.succeed(McpAuth)({ verifyBearer: (request) => @@ -106,28 +105,24 @@ const handleSeedOrg = async ( return new Response(null, { status: 204 }); }; -// Provide a WebSdk-backed tracer on the worker side so the `mcp.request` span -// gets reported to the OTLP receiver. This is the same Worker-safe telemetry -// layer used in prod. -const testMcpFetch = HttpEffect.toWebHandler( - mcpApp.pipe( - Effect.provide(Layer.mergeAll(TestMcpAuthLive, TestMcpOrganizationAuthLive, DoTelemetryLive)), - ), -); +// Build the same shared host-mcp envelope handler the prod worker uses, with +// the test auth seams swapped in. A WebSdk-backed tracer (DoTelemetryLive) is +// provided to the whole router so the `mcp.request` / `mcp.request.annotate` +// spans get reported to the OTLP receiver. +const testMcpFetch = makeMcpWebHandler({ + authProvider: cloudMcpAuthProviderLayer, + seamsRequirements: Layer.mergeAll(TestMcpAuthLive, TestMcpOrganizationAuthLive), + runtime: DoTelemetryLive, +}); -const realAuthMcpFetch = HttpEffect.toWebHandler( - mcpApp.pipe( - Effect.provide( - Layer.mergeAll( - McpAuthLive.pipe( - Layer.provide(ApiKeyService.WorkOS.pipe(Layer.provide(CoreSharedServices))), - ), - McpOrganizationAuthLive, - DoTelemetryLive, - ), - ), +const realAuthMcpFetch = makeMcpWebHandler({ + authProvider: cloudMcpAuthProviderLayer, + seamsRequirements: Layer.mergeAll( + McpAuthLive.pipe(Layer.provide(ApiKeyService.WorkOS.pipe(Layer.provide(CoreSharedServices)))), + McpOrganizationAuthLive, ), -); + runtime: DoTelemetryLive, +}); export default { async fetch(request: Request, envArg: Record): Promise { diff --git a/apps/cloud/src/web/api-key-atoms.ts b/apps/cloud/src/web/api-key-atoms.ts deleted file mode 100644 index b3b6cd9f8..000000000 --- a/apps/cloud/src/web/api-key-atoms.ts +++ /dev/null @@ -1,9 +0,0 @@ -import { ReactivityKey } from "@executor-js/react/api/reactivity-keys"; -import { CloudApiClient } from "./client"; - -export const apiKeysAtom = CloudApiClient.query("cloudAuth", "listApiKeys", { - reactivityKeys: [ReactivityKey.apiKeys], -}); - -export const createApiKey = CloudApiClient.mutation("cloudAuth", "createApiKey"); -export const revokeApiKey = CloudApiClient.mutation("cloudAuth", "revokeApiKey"); diff --git a/apps/cloud/src/web/auth.tsx b/apps/cloud/src/web/auth.tsx index 457fee83c..3f7f3be93 100644 --- a/apps/cloud/src/web/auth.tsx +++ b/apps/cloud/src/web/auth.tsx @@ -1,36 +1,29 @@ -import React, { createContext, useContext, useEffect } from "react"; +import React from "react"; import * as Atom from "effect/unstable/reactivity/Atom"; -import { useAtomValue } from "@effect/atom-react"; -import * as AsyncResult from "effect/unstable/reactivity/AsyncResult"; import { usePostHog } from "posthog-js/react"; import { ReactivityKey } from "@executor-js/react/api/reactivity-keys"; +import { + AuthProvider as SharedAuthProvider, + useAuth, + type IdentifyFn, +} from "@executor-js/react/multiplayer/auth-context"; import { CloudApiClient } from "./client"; // --------------------------------------------------------------------------- -// Types (from CloudAuthApi response schema) +// Cloud auth — the SHARED multiplayer auth seam (`useAuth` reads `/account/me`) +// with a thin cloud wrapper that wires PostHog identify/group/reset through the +// shared `onIdentify` callback. Identity comes from the provider-neutral +// account surface, identical to self-host. +// +// Cloud-only multi-org bits (org switcher, create-org, pending invites) stay +// here as cloud-local atoms over CloudApiClient — they are NOT part of the +// shared account contract and coexist with the shared `/account/*` atoms. // --------------------------------------------------------------------------- -type AuthUser = { - id: string; - email: string; - name: string | null; - avatarUrl: string | null; -}; - -type AuthOrganization = { - id: string; - name: string; -}; - -// --------------------------------------------------------------------------- -// Auth atom — typed query against CloudAuthApi -// --------------------------------------------------------------------------- +export { useAuth }; -export const authAtom = CloudApiClient.query("cloudAuth", "me", { - timeToLive: "5 minutes", - reactivityKeys: [ReactivityKey.auth], -}); +// ── Cloud-only multi-org atoms (CloudAuthApi) ────────────────────────────── export const organizationsAtom = Atom.refreshOnWindowFocus( CloudApiClient.query("cloudAuth", "organizations", { @@ -49,58 +42,27 @@ export const pendingInvitationsAtom = CloudApiClient.query("cloudAuth", "pending export const acceptInvitation = CloudApiClient.mutation("cloudAuth", "acceptInvitation"); -// --------------------------------------------------------------------------- -// Provider + hook -// --------------------------------------------------------------------------- +// ── Provider ─────────────────────────────────────────────────────────────── -type AuthState = - | { status: "loading" } - | { status: "unauthenticated" } - | { status: "authenticated"; user: AuthUser; organization: AuthOrganization | null }; - -const AuthContext = createContext({ status: "loading" }); - -export const useAuth = () => useContext(AuthContext); - -const AuthProviderClient = ({ children }: { children: React.ReactNode }) => { - const result = useAtomValue(authAtom); +export const AuthProvider = ({ children }: { children: React.ReactNode }) => { const posthog = usePostHog(); - const state: AuthState = AsyncResult.match(result, { - onInitial: () => ({ status: "loading" as const }), - onSuccess: ({ value }) => ({ - status: "authenticated" as const, - user: value.user, - organization: value.organization, - }), - onFailure: () => ({ status: "unauthenticated" as const }), - }); - - const userId = state.status === "authenticated" ? state.user.id : null; - const email = state.status === "authenticated" ? state.user.email : null; - const name = state.status === "authenticated" ? state.user.name : null; - const orgId = state.status === "authenticated" ? (state.organization?.id ?? null) : null; - const orgName = state.status === "authenticated" ? (state.organization?.name ?? null) : null; - const isUnauthenticated = state.status === "unauthenticated"; - - useEffect(() => { - if (!posthog) return; - if (userId) { - posthog.identify(userId, { email, name }); - if (orgId) { - posthog.group("organization", orgId, { name: orgName }); + const onIdentify = React.useCallback( + (state) => { + if (!posthog) return; + if (state.status === "authenticated") { + posthog.identify(state.user.id, { email: state.user.email, name: state.user.name }); + if (state.organization) { + posthog.group("organization", state.organization.id, { + name: state.organization.name, + }); + } + } else { + posthog.reset(); } - } else if (isUnauthenticated) { - posthog.reset(); - } - }, [posthog, userId, email, name, orgId, orgName, isUnauthenticated]); - - return {children}; -}; + }, + [posthog], + ); -export const AuthProvider = ({ children }: { children: React.ReactNode }) => { - if (typeof window === "undefined") { - return {children}; - } - return {children}; + return {children}; }; diff --git a/apps/cloud/src/web/components/org-menu-slot.tsx b/apps/cloud/src/web/components/org-menu-slot.tsx new file mode 100644 index 000000000..e144ccbbf --- /dev/null +++ b/apps/cloud/src/web/components/org-menu-slot.tsx @@ -0,0 +1,183 @@ +import { useState } from "react"; +import { useAtomValue, useAtomSet } from "@effect/atom-react"; +import * as AsyncResult from "effect/unstable/reactivity/AsyncResult"; +import * as Exit from "effect/Exit"; +import { authWriteKeys } from "@executor-js/react/api/reactivity-keys"; +import { Button } from "@executor-js/react/components/button"; +import { + Dialog, + DialogClose, + DialogContent, + DialogDescription, + DialogFooter, + DialogHeader, + DialogTitle, +} from "@executor-js/react/components/dialog"; +import { + DropdownMenuItem, + DropdownMenuLabel, + DropdownMenuSeparator, + DropdownMenuSub, + DropdownMenuSubContent, + DropdownMenuSubTrigger, +} from "@executor-js/react/components/dropdown-menu"; +import { useAuth } from "../auth"; +import { organizationsAtom, switchOrganization } from "../auth"; +import { CreateOrganizationFields, useCreateOrganizationForm } from "./create-organization-form"; + +// --------------------------------------------------------------------------- +// Cloud-only org-switcher slot for the shared shell's account dropdown. +// +// The shared `Shell` renders this `orgMenuSlot` ABOVE its API-keys link. Cloud +// is the only product with multiple organizations, so the switcher + create-org +// dialog live here and are injected, keeping the shared shell provider-neutral. +// The create-org dialog is controlled by local state so its `DialogContent` +// can live outside the dropdown menu while the trigger sits inside it. +// --------------------------------------------------------------------------- + +function CheckIcon() { + return ( + + + + ); +} + +function OrganizationSwitcherItems(props: { activeOrganizationId: string | null }) { + const organizations = useAtomValue(organizationsAtom); + const doSwitchOrganization = useAtomSet(switchOrganization, { mode: "promiseExit" }); + + const handleSwitch = async (organizationId: string) => { + if (organizationId === props.activeOrganizationId) return; + const exit = await doSwitchOrganization({ + payload: { organizationId }, + reactivityKeys: authWriteKeys, + }); + if (Exit.isSuccess(exit)) window.location.reload(); + }; + + return AsyncResult.match(organizations, { + onInitial: () => Loading…, + onFailure: () => Failed to load organizations, + onSuccess: ({ value }) => + value.organizations.length === 0 ? ( + No organizations + ) : ( + <> + {value.organizations.map((organization: { id: string; name: string }) => { + const isActive = organization.id === props.activeOrganizationId; + return ( + handleSwitch(organization.id)} + className="text-xs" + > + {organization.name} + {isActive && } + + ); + })} + + ), + }); +} + +export function OrgMenuSlot() { + const auth = useAuth(); + const [createOrganizationOpen, setCreateOrganizationOpen] = useState(false); + + const suggestedOrganizationName = + auth.status === "authenticated" && auth.user.name?.trim() !== "" && auth.user.name != null + ? `${auth.user.name}'s Organization` + : "New Organization"; + + const form = useCreateOrganizationForm({ + defaultName: suggestedOrganizationName, + onSuccess: () => window.location.reload(), + }); + + if (auth.status !== "authenticated") return null; + + const openCreateOrganization = () => { + form.reset(suggestedOrganizationName); + setCreateOrganizationOpen(true); + }; + + return ( + <> + + Organization + + + + + {auth.organization?.name ?? "No organization"} + + + + + + { + event.preventDefault(); + openCreateOrganization(); + }} + > + Create organization + + + + + + { + setCreateOrganizationOpen(open); + if (!open) form.reset(suggestedOrganizationName); + }} + > + + + Create organization + + Add another organization under your current account and switch into it immediately. + + + + { + form.setName(name); + if (form.error) form.setError(null); + }} + error={form.error} + onSubmit={() => void form.submit()} + /> + + + + + + + + + + + ); +} diff --git a/apps/cloud/src/web/components/support-slot.tsx b/apps/cloud/src/web/components/support-slot.tsx new file mode 100644 index 000000000..50f2ddf71 --- /dev/null +++ b/apps/cloud/src/web/components/support-slot.tsx @@ -0,0 +1,56 @@ +import { useState } from "react"; +import { Button } from "@executor-js/react/components/button"; +import { + Dialog, + DialogContent, + DialogDescription, + DialogHeader, + DialogTitle, +} from "@executor-js/react/components/dialog"; +import { SupportOptions } from "./support-options"; + +// --------------------------------------------------------------------------- +// Cloud-only "Get support" button for the shared shell's `supportSlot`. +// --------------------------------------------------------------------------- + +function HelpIcon({ className }: { className?: string }) { + return ( + + + + + ); +} + +export function SupportSlot() { + const [open, setOpen] = useState(false); + return ( + + + + + Get support + + Reach out through any of the channels below. + + +
+ +
+ + + ); +} diff --git a/apps/cloud/src/web/org-atoms.ts b/apps/cloud/src/web/org-atoms.ts index 8abf03068..3ae889a20 100644 --- a/apps/cloud/src/web/org-atoms.ts +++ b/apps/cloud/src/web/org-atoms.ts @@ -2,23 +2,10 @@ import * as Atom from "effect/unstable/reactivity/Atom"; import { ReactivityKey } from "@executor-js/react/api/reactivity-keys"; import { CloudApiClient } from "./client"; -export const orgMembersAtom = Atom.refreshOnWindowFocus( - CloudApiClient.query("org", "listMembers", { - timeToLive: "30 seconds", - reactivityKeys: [ReactivityKey.orgMembers], - }), -); - -export const orgRolesAtom = CloudApiClient.query("org", "listRoles", { - timeToLive: "5 minutes", - reactivityKeys: [ReactivityKey.orgMembers], -}); - -export const inviteMember = CloudApiClient.mutation("org", "invite"); - -export const removeMember = CloudApiClient.mutation("org", "removeMember"); - -export const updateMemberRole = CloudApiClient.mutation("org", "updateMemberRole"); +// Cloud-only WorkOS domain-verification atoms over the surviving `/org/domains` +// endpoints. Members / roles / invite / org-name now flow through the shared +// `@executor-js/react` account atoms (`/account/*`), so they no longer live +// here. export const orgDomainsAtom = Atom.refreshOnWindowFocus( CloudApiClient.query("org", "listDomains", { @@ -33,5 +20,3 @@ export const getDomainVerificationLink = CloudApiClient.mutation( ); export const deleteDomain = CloudApiClient.mutation("org", "deleteDomain"); - -export const updateOrgName = CloudApiClient.mutation("org", "updateOrgName"); diff --git a/apps/cloud/src/web/shell.tsx b/apps/cloud/src/web/shell.tsx index cd97ea869..0c3c2cf6a 100644 --- a/apps/cloud/src/web/shell.tsx +++ b/apps/cloud/src/web/shell.tsx @@ -1,569 +1,38 @@ -import { Link, Outlet, useLocation } from "@tanstack/react-router"; -import { useEffect, useRef, useState } from "react"; -import { useAtomValue, useAtomSet } from "@effect/atom-react"; -import * as AsyncResult from "effect/unstable/reactivity/AsyncResult"; -import * as Exit from "effect/Exit"; -import { sourcesOptimisticAtom } from "@executor-js/react/api/atoms"; -import { useScope } from "@executor-js/react/api/scope-context"; -import { Button } from "@executor-js/react/components/button"; -import { Skeleton } from "@executor-js/react/components/skeleton"; -import { - Dialog, - DialogClose, - DialogContent, - DialogDescription, - DialogFooter, - DialogHeader, - DialogTitle, -} from "@executor-js/react/components/dialog"; -import { SupportOptions } from "./components/support-options"; -import { - DropdownMenu, - DropdownMenuContent, - DropdownMenuItem, - DropdownMenuLabel, - DropdownMenuSeparator, - DropdownMenuSub, - DropdownMenuSubContent, - DropdownMenuSubTrigger, - DropdownMenuTrigger, -} from "@executor-js/react/components/dropdown-menu"; -import { SourceFavicon, sourcePresetIconUrl } from "@executor-js/react/components/source-favicon"; -import { CommandPalette } from "@executor-js/react/components/command-palette"; -import { useSourcePlugins } from "@executor-js/sdk/client"; -import { authWriteKeys } from "@executor-js/react/api/reactivity-keys"; +import { Shell as SharedShell, defaultShellNavItems } from "@executor-js/react/multiplayer/shell"; import { AUTH_PATHS } from "../auth/api"; -import { organizationsAtom, switchOrganization, useAuth } from "./auth"; -import { - CreateOrganizationFields, - useCreateOrganizationForm, -} from "./components/create-organization-form"; - -// ── Brand ──────────────────────────────────────────────────────────────── - -function Brand(props: { onNavigate?: () => void }) { - return ( - - executor - - Beta - - - ); -} - -// ── NavItem ────────────────────────────────────────────────────────────── - -function NavItem(props: { to: string; label: string; active: boolean; onNavigate?: () => void }) { - return ( - - {props.label} - - ); -} - -// ── SourceList ─────────────────────────────────────────────────────────── - -function SourceList(props: { pathname: string; onNavigate?: () => void }) { - const scopeId = useScope(); - const sources = useAtomValue(sourcesOptimisticAtom(scopeId)); - const sourcePlugins = useSourcePlugins(); - - return AsyncResult.match(sources, { - onInitial: () => ( -
- {[80, 65, 72, 58, 68].map((w, i) => ( -
- - -
- ))} -
- ), - onFailure: () => ( -
No sources yet
- ), - onSuccess: ({ value }) => - value.length === 0 ? ( -
- No sources yet -
- ) : ( -
- {value.map((s) => { - const detailPath = `/sources/${s.id}`; - const active = - props.pathname === detailPath || props.pathname.startsWith(`${detailPath}/`); - return ( - - - {s.name} - - {s.kind} - - - ); - })} -
- ), - }); -} - -// ── UserFooter ────────────────────────────────────────────────────────── - -function initialsFor(name: string | null, email: string) { - if (name) { - return name - .split(" ") - .map((n) => n[0]) - .join("") - .slice(0, 2) - .toUpperCase(); - } - return email[0]!.toUpperCase(); -} - -function Avatar(props: { - url: string | null; - name: string | null; - email: string; - size?: "sm" | "md"; -}) { - const size = props.size === "md" ? "size-8" : "size-7"; - const text = props.size === "md" ? "text-sm" : "text-xs"; - if (props.url) { - return ; - } - return ( -
- {initialsFor(props.name, props.email)} -
- ); -} - -function OrganizationSwitcherItems(props: { activeOrganizationId: string | null }) { - const organizations = useAtomValue(organizationsAtom); - const doSwitchOrganization = useAtomSet(switchOrganization, { mode: "promiseExit" }); - - const handleSwitch = async (organizationId: string) => { - if (organizationId === props.activeOrganizationId) return; - const exit = await doSwitchOrganization({ - payload: { organizationId }, - reactivityKeys: authWriteKeys, - }); - if (Exit.isSuccess(exit)) window.location.reload(); - }; - - return AsyncResult.match(organizations, { - onInitial: () => Loading…, - onFailure: () => Failed to load organizations, - onSuccess: ({ value }) => - value.organizations.length === 0 ? ( - No organizations - ) : ( - <> - {value.organizations.map((organization: { id: string; name: string }) => { - const isActive = organization.id === props.activeOrganizationId; - return ( - handleSwitch(organization.id)} - className="text-xs" - > - {organization.name} - {isActive && } - - ); - })} - - ), - }); -} - -function CheckIcon() { - return ( - - - - ); -} - -function UserFooter() { - const auth = useAuth(); - const [createOrganizationOpen, setCreateOrganizationOpen] = useState(false); - - const suggestedOrganizationName = - auth.status === "authenticated" && auth.user.name?.trim() !== "" && auth.user.name != null - ? `${auth.user.name}'s Organization` - : "New Organization"; - - const form = useCreateOrganizationForm({ - defaultName: suggestedOrganizationName, - onSuccess: () => window.location.reload(), - }); - - if (auth.status !== "authenticated") return null; - - const openCreateOrganization = () => { - form.reset(suggestedOrganizationName); - setCreateOrganizationOpen(true); - }; - - return ( -
- { - setCreateOrganizationOpen(open); - if (!open) form.reset(suggestedOrganizationName); - }} - > - - - - - - - Organization - - - - - {auth.organization?.name ?? "No organization"} - - - - - - { - event.preventDefault(); - openCreateOrganization(); - }} - > - Create organization - - - - - - API keys - - - - Signed in as - - - -
-

- {auth.user.name ?? auth.user.email} -

- {auth.user.name && ( -

{auth.user.email}

- )} -
- - { - await fetch(AUTH_PATHS.logout, { method: "POST" }); - window.location.href = "/"; - }} - > - Sign out - - - - - - - Create organization - - Add another organization under your current account and switch into it immediately. - - - - { - form.setName(name); - if (form.error) form.setError(null); - }} - error={form.error} - onSubmit={() => void form.submit()} - /> - - - - - - - - - -
- ); -} - -// ── SupportButton ──────────────────────────────────────────────────────── - -function HelpIcon({ className }: { className?: string }) { - return ( - - - - - ); -} - -function SupportButton() { - const [open, setOpen] = useState(false); - return ( - - - - - Get support - - Reach out through any of the channels below. - - -
- -
- - - ); -} - -// ── SidebarContent ─────────────────────────────────────────────────────── - -function SidebarContent(props: { pathname: string; onNavigate?: () => void; showBrand?: boolean }) { - const isHome = props.pathname === "/"; - const isSecrets = props.pathname === "/secrets"; - const isConnections = props.pathname === "/connections"; - const isPolicies = props.pathname === "/policies"; - const isBilling = props.pathname === "/billing" || props.pathname.startsWith("/billing/"); - const isOrg = props.pathname === "/org"; - - return ( - <> - {props.showBrand !== false && ( -
- -
- )} - - - -
- -
- - - - ); -} - -// ── Shell ───────────────────────────────────────────────────────────────── +import { OrgMenuSlot } from "./components/org-menu-slot"; +import { SupportSlot } from "./components/support-slot"; + +// --------------------------------------------------------------------------- +// Cloud shell — the SHARED multiplayer shell, identical to self-host, with +// cloud-only bits injected through its slots: +// - sign-out POST cloud's WorkOS logout, then redirect home +// - nav items defaults + Organization + Billing (cloud-only sections) +// - org menu slot multi-org switcher + create-org dialog (cloud-only) +// - support slot the "Get support" dialog button (cloud-only) +// The shared shell already renders the account dropdown frame, API-keys link, +// and sign-out; `orgMenuSlot` is injected above the API-keys link. +// --------------------------------------------------------------------------- + +const navItems = [ + ...defaultShellNavItems, + { to: "/org", label: "Organization" }, + { to: "/billing", label: "Billing" }, +]; + +const signOut = async () => { + await fetch(AUTH_PATHS.logout, { method: "POST" }); + window.location.href = "/"; +}; export function Shell() { - const location = useLocation(); - const pathname = location.pathname; - const lastPathname = useRef(pathname); - const [mobileSidebarOpen, setMobileSidebarOpen] = useState(false); - if (lastPathname.current !== pathname) { - lastPathname.current = pathname; - if (mobileSidebarOpen) setMobileSidebarOpen(false); - } - - // Lock scroll when mobile sidebar open - useEffect(() => { - if (!mobileSidebarOpen) return; - const prev = document.body.style.overflow; - document.body.style.overflow = "hidden"; - return () => { - document.body.style.overflow = prev; - }; - }, [mobileSidebarOpen]); - return ( -
- - {/* Desktop sidebar */} - - - {/* Mobile sidebar overlay */} - {mobileSidebarOpen && ( -
- {/* oxlint-disable-next-line react/forbid-elements */} - -
- setMobileSidebarOpen(false)} - showBrand={false} - /> -
- - )} - - {/* Main content */} -
- {/* Mobile top bar */} -
- - -
-
- - -
- + } + supportSlot={} + /> ); } diff --git a/apps/cloud/test-stubs/tanstack-start-entry.ts b/apps/cloud/test-stubs/tanstack-start-entry.ts new file mode 100644 index 000000000..84b94b1bb --- /dev/null +++ b/apps/cloud/test-stubs/tanstack-start-entry.ts @@ -0,0 +1,20 @@ +// Test-only stub for TanStack Start's `#tanstack-*` subpath-imports specifiers. +// +// `@tanstack/start-server-core` (reached transitively from +// `@tanstack/react-start/server`, which `auth/handlers.ts` uses for +// `setCookie`/`deleteCookie`) does `import("#tanstack-start-entry")` / +// `"#tanstack-router-entry"` / `"#tanstack-start-plugin-adapters"`. Those +// `imports`-field specifiers are declared on `@tanstack/start-client-core`, +// not on `start-server-core`, so Vite's resolver — used by the workerd vitest +// pool — can't find them relative to the importing package and errors at module +// load (`Missing "#tanstack-router-entry" specifier in "@tanstack/start-server-core"`). +// +// In real builds the app's bundler injects the user's generated entry here; in +// the SSR/handler code-path cloud never exercises (cloud only calls the cookie +// helpers), so the union of the fake-entry export surfaces is enough to let the +// module graph load. The vitest configs alias all three `#tanstack-*` +// specifiers to this single stub. +export const startInstance = undefined; +export function getRouter() {} +export const pluginSerializationAdapters: readonly unknown[] = []; +export const hasPluginAdapters = false; diff --git a/apps/cloud/vitest.config.ts b/apps/cloud/vitest.config.ts index 68be4ca21..bc71ac8e4 100644 --- a/apps/cloud/vitest.config.ts +++ b/apps/cloud/vitest.config.ts @@ -1,12 +1,33 @@ +import { resolve } from "node:path"; + import { cloudflareTest } from "@cloudflare/vitest-pool-workers"; import { defineConfig } from "vitest/config"; +// `auth/handlers.ts` imports `setCookie`/`deleteCookie` from +// `@tanstack/react-start/server`. That barrel transitively pulls in +// `@tanstack/start-server-core`, which does `import("#tanstack-start-entry")` +// (+ `#tanstack-router-entry` / `#tanstack-start-plugin-adapters`). Those +// `imports`-field specifiers are declared on `@tanstack/start-client-core`, +// not on `start-server-core`, so Vite's resolver (used by the workerd pool) +// can't resolve them relative to the importing package and the module graph +// fails to load. Alias the three specifiers to a no-op stub so the workerd +// pool can load any module that transitively imports react-start. Cloud only +// uses the cookie helpers, never the SSR handler path the stub shims out. +const tanstackStartEntryStub = resolve(__dirname, "./test-stubs/tanstack-start-entry.ts"); + export default defineConfig({ plugins: [ cloudflareTest({ wrangler: { configPath: "./wrangler.test.jsonc" }, }), ], + resolve: { + alias: { + "#tanstack-start-entry": tanstackStartEntryStub, + "#tanstack-router-entry": tanstackStartEntryStub, + "#tanstack-start-plugin-adapters": tanstackStartEntryStub, + }, + }, test: { include: ["src/**/*.test.ts"], exclude: ["src/**/*.node.test.ts", "**/node_modules/**"], diff --git a/apps/cloud/wrangler.miniflare.jsonc b/apps/cloud/wrangler.miniflare.jsonc index 0221bfd59..2fdcf89e4 100644 --- a/apps/cloud/wrangler.miniflare.jsonc +++ b/apps/cloud/wrangler.miniflare.jsonc @@ -17,6 +17,7 @@ "MCP_AUTHKIT_DOMAIN": "https://test-authkit.example.com", "MCP_RESOURCE_ORIGIN": "https://test-resource.example.com", "NODE_ENV": "test", + "ALLOW_LOCAL_NETWORK": "true", }, "durable_objects": { "bindings": [{ "name": "MCP_SESSION", "class_name": "McpSessionDO" }], diff --git a/apps/cloud/wrangler.test.jsonc b/apps/cloud/wrangler.test.jsonc index 4009b6fa9..134451f03 100644 --- a/apps/cloud/wrangler.test.jsonc +++ b/apps/cloud/wrangler.test.jsonc @@ -13,6 +13,7 @@ "MCP_AUTHKIT_DOMAIN": "https://test-authkit.example.com", "MCP_RESOURCE_ORIGIN": "https://test-resource.example.com", "NODE_ENV": "test", + "ALLOW_LOCAL_NETWORK": "true", }, "durable_objects": { "bindings": [{ "name": "MCP_SESSION", "class_name": "McpSessionDO" }], diff --git a/apps/host-selfhost/.executor-selfhost/secret.key b/apps/host-selfhost/.executor-selfhost/secret.key new file mode 100644 index 000000000..042fa11ed --- /dev/null +++ b/apps/host-selfhost/.executor-selfhost/secret.key @@ -0,0 +1 @@ +f791Y+ZWt0l8Zguif5YjmU/WhDkjCUNsTzN9ntxZiWk= \ No newline at end of file diff --git a/apps/host-selfhost/CHANGELOG.md b/apps/host-selfhost/CHANGELOG.md new file mode 100644 index 000000000..208ebc58c --- /dev/null +++ b/apps/host-selfhost/CHANGELOG.md @@ -0,0 +1,6 @@ +# @executor-js/host-selfhost changelog + +This file exists for `changesets/action@v1` compatibility (it reads every +workspace package's `CHANGELOG.md` to build the Version Packages PR). +Canonical user-facing release notes are at `apps/cli/release-notes/next.md` +and on the GitHub Releases page. diff --git a/apps/host-selfhost/Dockerfile b/apps/host-selfhost/Dockerfile new file mode 100644 index 000000000..609d8534d --- /dev/null +++ b/apps/host-selfhost/Dockerfile @@ -0,0 +1,39 @@ +# Self-hosted Executor — single container, no external services. +# Build context is the REPO ROOT (the bun workspace install needs every member): +# docker build -f apps/host-selfhost/Dockerfile -t executor-selfhost . +# +# Runtime needs nothing but this container + a volume for the data dir: +# docker run -p 4788:4788 -e BETTER_AUTH_SECRET=$(openssl rand -hex 32) \ +# -e EXECUTOR_BOOTSTRAP_ADMIN_EMAIL=you@example.com \ +# -e EXECUTOR_BOOTSTRAP_ADMIN_PASSWORD=... \ +# -e EXECUTOR_WEB_BASE_URL=https://your.domain \ +# -v executor-data:/data executor-selfhost +# +# SQLite (libSQL, file:/data/...) lives in /data, QuickJS + MCP run in-process — +# so unlike windmill there's no postgres/worker/proxy to orchestrate. + +# ── Build stage: install the workspace + build the SPA ────────────────────── +FROM oven/bun:1 AS build +WORKDIR /app +COPY . . +# Full install (dev deps included — vite/turbo/plugins are needed to build). +RUN bun install --frozen-lockfile +# Builds @executor-js/vite-plugin (via turbo) then the self-host SPA into +# apps/host-selfhost/dist. +RUN cd apps/host-selfhost && bun run build + +# ── Runtime stage: serve the built app under Bun ──────────────────────────── +FROM oven/bun:1 AS runtime +WORKDIR /app +ENV NODE_ENV=production \ + EXECUTOR_HOST=0.0.0.0 \ + PORT=4788 \ + EXECUTOR_DATA_DIR=/data +COPY --from=build /app /app +WORKDIR /app/apps/host-selfhost +RUN mkdir -p /data +VOLUME ["/data"] +EXPOSE 4788 +# serve.ts binds the Effect AppLayer (API + /mcp + /api/auth + /docs) and serves +# the built SPA from ./dist — one process. +CMD ["bun", "run", "src/serve.ts"] diff --git a/apps/host-selfhost/executor.config.ts b/apps/host-selfhost/executor.config.ts new file mode 100644 index 000000000..1d41b2d7e --- /dev/null +++ b/apps/host-selfhost/executor.config.ts @@ -0,0 +1,28 @@ +import { defineExecutorConfig } from "@executor-js/sdk"; +import { openApiHttpPlugin } from "@executor-js/plugin-openapi/api"; +import { mcpHttpPlugin } from "@executor-js/plugin-mcp/api"; +import { graphqlHttpPlugin } from "@executor-js/plugin-graphql/api"; +import { encryptedSecretsPlugin } from "@executor-js/plugin-encrypted-secrets"; + +import { resolveSecretKey } from "./src/config"; + +// --------------------------------------------------------------------------- +// Single source of truth for the self-hosted app's plugin list. +// +// Self-host runs the same protocol/provider plugins as cloud, minus the +// multi-tenant-only secret backends (WorkOS Vault). `dangerouslyAllowStdioMCP` +// is false: a server reachable by multiple users must not let one user spawn +// arbitrary stdio MCP processes on the host. The encrypted DB secret provider +// (slice 4) is added here as the first writable secret provider. +// --------------------------------------------------------------------------- + +export default defineExecutorConfig({ + plugins: () => + [ + openApiHttpPlugin(), + mcpHttpPlugin({ dangerouslyAllowStdioMCP: false }), + graphqlHttpPlugin(), + // First writable secret provider -> the default for `secrets.set`. + encryptedSecretsPlugin({ key: resolveSecretKey() }), + ] as const, +}); diff --git a/apps/host-selfhost/package.json b/apps/host-selfhost/package.json new file mode 100644 index 000000000..d967253a9 --- /dev/null +++ b/apps/host-selfhost/package.json @@ -0,0 +1,58 @@ +{ + "name": "@executor-js/host-selfhost", + "version": "0.0.0", + "private": true, + "type": "module", + "exports": { + ".": "./src/index.ts", + "./serve": "./src/serve.ts" + }, + "scripts": { + "dev": "bunx --bun vite dev", + "build": "turbo run build --filter @executor-js/vite-plugin && vite build", + "start": "bun run src/serve.ts", + "typecheck": "tsgo --noEmit", + "test": "vitest run", + "test:watch": "vitest" + }, + "dependencies": { + "@better-auth/api-key": "^1.6.11", + "@effect/atom-react": "catalog:", + "@effect/platform-bun": "catalog:", + "@executor-js/api": "workspace:*", + "@executor-js/app": "workspace:*", + "@executor-js/execution": "workspace:*", + "@executor-js/host-mcp": "workspace:*", + "@executor-js/plugin-encrypted-secrets": "workspace:*", + "@executor-js/plugin-graphql": "workspace:*", + "@executor-js/plugin-mcp": "workspace:*", + "@executor-js/plugin-openapi": "workspace:*", + "@executor-js/react": "workspace:*", + "@executor-js/runtime-quickjs": "workspace:*", + "@executor-js/sdk": "workspace:*", + "@libsql/client": "catalog:", + "@libsql/kysely-libsql": "catalog:", + "@modelcontextprotocol/sdk": "^1.29.0", + "@tanstack/react-router": "catalog:", + "better-auth": "^1.6.11", + "drizzle-orm": "catalog:", + "effect": "catalog:", + "fumadb": "workspace:*", + "react": "catalog:", + "react-dom": "catalog:" + }, + "devDependencies": { + "@effect/vitest": "catalog:", + "@executor-js/vite-plugin": "workspace:*", + "@tailwindcss/vite": "catalog:", + "@tanstack/router-plugin": "^1.167.12", + "@types/node": "catalog:", + "@types/react": "catalog:", + "@types/react-dom": "catalog:", + "@vitejs/plugin-react": "catalog:", + "bun-types": "catalog:", + "typescript": "catalog:", + "vite": "catalog:", + "vitest": "catalog:" + } +} diff --git a/apps/host-selfhost/src/account/account-api.ts b/apps/host-selfhost/src/account/account-api.ts new file mode 100644 index 000000000..c39863c51 --- /dev/null +++ b/apps/host-selfhost/src/account/account-api.ts @@ -0,0 +1,27 @@ +import { Layer } from "effect"; + +import { accountProviderMiddlewareLayer } from "@executor-js/api/server"; + +import { BetterAuth, type BetterAuthHandle } from "../auth/better-auth"; +import { betterAuthAccountProvider } from "./better-auth-account-provider"; + +// --------------------------------------------------------------------------- +// Self-host account seam: the per-request `AccountProvider` middleware backed by +// Better Auth. `ExecutorApp.make` mounts the shared, provider-neutral +// `AccountHandlers` behind it under the `/api` prefix (same prefixed router as +// the plugin API). The provider does its OWN auth (each handler resolves the +// session via the request headers), so it is NOT wrapped by the execution-stack +// middleware — account requests never build a code executor. +// +// The handlers `yield* AccountProvider` at request time; providing it through a +// router middleware (like the plugin API's ExecutionStackMiddleware provides +// ExecutorService) satisfies the requirement without leaking into the app +// layer's output. The Better Auth `AccountProvider` is self-contained, so it +// goes through the common-case `accountProviderMiddlewareLayer` (wraps it in +// `requestScopedMiddleware`). +// --------------------------------------------------------------------------- + +export const selfHostAccountMiddleware = (betterAuth: BetterAuthHandle) => + accountProviderMiddlewareLayer( + betterAuthAccountProvider.pipe(Layer.provide(Layer.succeed(BetterAuth)(betterAuth))), + ); diff --git a/apps/host-selfhost/src/account/better-auth-account-provider.ts b/apps/host-selfhost/src/account/better-auth-account-provider.ts new file mode 100644 index 000000000..48f7b6afe --- /dev/null +++ b/apps/host-selfhost/src/account/better-auth-account-provider.ts @@ -0,0 +1,179 @@ +import { Effect, Layer } from "effect"; + +import { AccountProvider, type AccountHeaders } from "@executor-js/api/server"; +import { AccountError, AccountUnauthorized } from "@executor-js/api"; + +import { BetterAuth } from "../auth/better-auth"; + +// --------------------------------------------------------------------------- +// Self-host AccountProvider — implements the provider-neutral account surface +// over the Better Auth instance (auth.api.*). The shared AccountHandlers call +// this; cloud provides its own WorkOS-backed implementation of the same shape. +// +// Single-org instance: organization id/name come from the boot-seeded org. +// auth.api.* throws on failure; we map those to the neutral AccountError so the +// UI sees one shape. API keys returned by `list` only expose a masked value; +// the plaintext is returned once, by `create`. +// --------------------------------------------------------------------------- + +const toHeaders = (headers: AccountHeaders): Headers => new Headers(headers); + +const isoOrNull = (value: Date | string | null | undefined): string | null => { + if (!value) return null; + return value instanceof Date ? value.toISOString() : value; +}; + +const iso = (value: Date | string | null | undefined): string => isoOrNull(value) ?? ""; + +// Better Auth exposes only `start` (leading chars) for display once a key is +// stored; render it as a masked token. +const masked = (start: string | null | undefined): string => (start ? `${start}…` : "••••••••"); + +// Narrow a free-form role slug to the Better Auth organization role union +// (defaults to member). Returning literals — not a cast — keeps the types sound. +const orgRole = (slug: string | undefined): "owner" | "admin" | "member" => + slug === "owner" ? "owner" : slug === "admin" ? "admin" : "member"; + +export const betterAuthAccountProvider: Layer.Layer = + Layer.effect(AccountProvider)( + Effect.gen(function* () { + const { auth, organizationId, organizationName } = yield* BetterAuth; + + const getSession = (headers: AccountHeaders) => + Effect.tryPromise({ + try: () => auth.api.getSession({ headers: toHeaders(headers) }), + catch: () => new AccountError({ message: "Failed to resolve session" }), + }).pipe(Effect.orElseSucceed(() => null)); + + // Run a Better Auth api call, mapping any rejection to a neutral + // AccountError with a stable, user-facing message. + const call = (message: string, run: () => Promise) => + Effect.tryPromise({ try: run, catch: () => new AccountError({ message }) }); + + return AccountProvider.of({ + me: (headers) => + Effect.gen(function* () { + const resolved = yield* getSession(headers); + if (!resolved) return yield* new AccountUnauthorized(); + return { + user: { + id: resolved.user.id, + email: resolved.user.email, + name: resolved.user.name ?? null, + avatarUrl: resolved.user.image ?? null, + }, + organization: { + id: resolved.session.activeOrganizationId ?? organizationId, + name: organizationName, + }, + }; + }), + + listApiKeys: (headers) => + call("Failed to list API keys", () => + auth.api.listApiKeys({ headers: toHeaders(headers) }), + ).pipe( + Effect.map((result) => ({ + apiKeys: result.apiKeys.map((key) => ({ + id: key.id, + name: key.name ?? "API key", + obfuscatedValue: masked(key.start), + createdAt: iso(key.createdAt), + updatedAt: iso(key.updatedAt), + lastUsedAt: isoOrNull(key.lastRequest), + })), + })), + ), + + createApiKey: (headers, name) => + call("Failed to create API key", () => + auth.api.createApiKey({ body: { name }, headers: toHeaders(headers) }), + ).pipe( + Effect.map((key) => ({ + id: key.id, + name: key.name ?? name, + obfuscatedValue: masked(key.start), + createdAt: iso(key.createdAt), + updatedAt: iso(key.updatedAt), + lastUsedAt: isoOrNull(key.lastRequest), + value: key.key, + })), + ), + + revokeApiKey: (headers, apiKeyId) => + call("Failed to revoke API key", () => + auth.api.deleteApiKey({ body: { keyId: apiKeyId }, headers: toHeaders(headers) }), + ).pipe(Effect.as({ success: true })), + + listMembers: (headers) => + Effect.gen(function* () { + const resolved = yield* getSession(headers); + const currentUserId = resolved?.user.id; + const result = yield* call("Failed to list members", () => + auth.api.listMembers({ headers: toHeaders(headers) }), + ).pipe( + Effect.catchTag("AccountError", () => Effect.succeed({ members: [], total: 0 })), + ); + const members = result.members.map((member) => ({ + id: member.id, + userId: member.userId, + email: member.user?.email ?? "", + name: member.user?.name ?? null, + avatarUrl: member.user?.image ?? null, + role: member.role, + status: "active", + lastActiveAt: null, + isCurrentUser: member.userId === currentUserId, + })); + return { + members, + seats: { used: members.length, granted: members.length, unlimited: true }, + }; + }), + + // Better Auth's organization plugin ships fixed roles; expose the common + // set so the invite/role UI has options on a single-team instance. + listRoles: () => + Effect.succeed({ + roles: [ + { slug: "owner", name: "Owner" }, + { slug: "admin", name: "Admin" }, + { slug: "member", name: "Member" }, + ], + }), + + inviteMember: (headers, body) => + call("Failed to invite member", () => + auth.api.createInvitation({ + // Narrow the free-form slug to the org plugin's role union (no cast). + body: { email: body.email, role: orgRole(body.roleSlug) }, + headers: toHeaders(headers), + }), + ).pipe(Effect.map((invite) => ({ id: invite.id, email: invite.email }))), + + removeMember: (headers, membershipId) => + call("Failed to remove member", () => + auth.api.removeMember({ + body: { memberIdOrEmail: membershipId }, + headers: toHeaders(headers), + }), + ).pipe(Effect.as({ success: true })), + + updateMemberRole: (headers, membershipId, roleSlug) => + call("Failed to update member role", () => + auth.api.updateMemberRole({ + body: { memberId: membershipId, role: roleSlug }, + headers: toHeaders(headers), + }), + ).pipe(Effect.as({ success: true })), + + updateOrgName: (headers, name) => + call("Failed to update organization name", () => + auth.api.updateOrganization({ + body: { data: { name }, organizationId }, + headers: toHeaders(headers), + }), + ).pipe(Effect.as({ name })), + }); + }), + ); diff --git a/apps/host-selfhost/src/account/index.ts b/apps/host-selfhost/src/account/index.ts new file mode 100644 index 000000000..96e281d11 --- /dev/null +++ b/apps/host-selfhost/src/account/index.ts @@ -0,0 +1,7 @@ +// The self-host account surface: the per-request `AccountProvider` middleware +// backed by Better Auth. `ExecutorApp.make` mounts the shared, provider-neutral +// `AccountHandlers` behind it under /api (Better-Auth-only — the test stub path +// doesn't serve it). `selfHostAccountMiddleware` builds the middleware Layer from +// a Better Auth handle. +export { selfHostAccountMiddleware } from "./account-api"; +export { betterAuthAccountProvider } from "./better-auth-account-provider"; diff --git a/apps/host-selfhost/src/app.ts b/apps/host-selfhost/src/app.ts new file mode 100644 index 000000000..d20816e0c --- /dev/null +++ b/apps/host-selfhost/src/app.ts @@ -0,0 +1,124 @@ +import { HttpApiSwagger } from "effect/unstable/httpapi"; +import { HttpEffect, HttpRouter } from "effect/unstable/http"; +import { Layer } from "effect"; + +import { composePluginApi, ExecutorApp, textFailureStrategy } from "@executor-js/api/server"; + +import { resolveAuthProviders } from "./auth"; +import { selfHostAccountMiddleware } from "./account"; +import { loadConfig, SELF_HOST_NAMESPACE, SELF_HOST_SCHEMA_VERSION } from "./config"; +import { createSelfHostDb, SelfHostDb, SelfHostDbProvider } from "./db/self-host-db"; +import { + SelfHostCodeExecutorProvider, + SelfHostHostConfig, + SelfHostPluginsProvider, +} from "./execution"; +import { makeSelfHostMcpSeams } from "./mcp"; +import { selfHostPlugins } from "./plugins"; +import { ErrorCaptureLive } from "./observability"; + +// =========================================================================== +// The self-hosted Executor app, as ONE `ExecutorApp.make` call. +// +// The whole scenario in 60 seconds: Better Auth (cookie/bearer/api-key identity +// + /api/auth handler + account API + MCP OAuth) over a libSQL file, QuickJS +// in-process code execution, in-process MCP, console error capture, Swagger at +// /docs — and NO billing (the cloud `extensions.services` + /autumn route are +// simply absent). `diff` against the cloud app is the entire product difference. +// +// `ExecutorApp.make` owns the assembly (execution-stack middleware wrapping the +// protected API, the MCP envelope, the account API on the /api-prefixed router, +// the extension routes, provideMerge(boot)). This file's job is the eager async +// boot + slotting self-host's seam Layers into the named slots. +// +// Built eagerly (async) so the DB connection, schema migration, and Better Auth +// org/admin seeding happen at boot — fail fast on misconfig. The DB is opened +// ONCE and shared (Layer.succeed) by the per-request executor, Better Auth, and +// the MCP session store. +// =========================================================================== + +export interface MakeSelfHostAppOptions { + /** Override the SQLite path (tests point at a throwaway file). */ + readonly dbPath?: string; +} + +export const makeSelfHostApp = async (options: MakeSelfHostAppOptions = {}) => { + const config = loadConfig(); + + // ---- eager async boot: the shared libSQL handle ----------------------- + const dbHandle = await createSelfHostDb({ + path: options.dbPath ?? config.dbPath, + namespace: SELF_HOST_NAMESPACE, + version: SELF_HOST_SCHEMA_VERSION, + }); + + // ---- auth providers --------------------------------------------------- + // Better Auth: cookie/bearer/api-key identity + /api/auth handler + account + // API + MCP OAuth seam, all over the shared libSQL handle. + const { identityLayer, authHandler, betterAuth } = await resolveAuthProviders(dbHandle); + + // ---- the in-process MCP serving seams (+ shutdown hook) ---------------- + const mcp = makeSelfHostMcpSeams(dbHandle, betterAuth); + + const { appLayer, toWebHandler } = ExecutorApp.make({ + plugins: selfHostPlugins, + providers: { + identity: identityLayer, + account: selfHostAccountMiddleware(betterAuth), + db: SelfHostDbProvider, + engine: { codeExecutor: SelfHostCodeExecutorProvider }, // decorator defaults to no-op (no metering) + mcp: { auth: mcp.auth, sessions: mcp.sessions, reporter: mcp.reporter }, + plugins: { provider: SelfHostPluginsProvider, config: SelfHostHostConfig }, + errorCapture: ErrorCaptureLive, + }, + extensions: { + routes: [ + // Better Auth owns /api/auth/* — the full path reaches it unmodified. + HttpRouter.add("*", "/api/auth/*", HttpEffect.fromWebHandler(authHandler)), + // Swagger UI at /docs, over the /api-prefixed spec (matches the served paths). + HttpApiSwagger.layer(composePluginApi(selfHostPlugins).prefix("/api"), { path: "/docs" }), + ], + }, + config: { mountPrefix: "/api", failure: textFailureStrategy }, + // The boot-scoped context provideMerge'd under everything: the long-lived DB + // handle (read by the DbProvider seam, Better Auth, and the MCP store) + the + // resolved identity (captured once by the execution middleware + MCP auth). + boot: Layer.merge(Layer.succeed(SelfHostDb)(dbHandle), identityLayer), + }); + + return { + // Every route requirement is provided (the seams + boot resolve to nothing + // residual), so the assembled app is a `Layer` — the precise shape + // `serve.ts` binds to the Bun socket. `make` types its `appLayer` loosely + // (it can't prove each host's resolution); self-host narrows it here. + AppLayer: appLayer as Layer.Layer, + toWebHandler, + closeDb: async () => { + await mcp.close(); + await dbHandle.close(); + }, + }; +}; + +export interface SelfHostApiHandler { + /** Unified web handler: serves /api/*, /api/auth/*, /mcp, and /docs. */ + readonly handler: (request: Request) => Promise; + readonly dispose: () => Promise; +} + +// Web-handler binding of `AppLayer` — used by tests (and the same shape cloud +// uses for Workers). The self-host server (serve.ts) binds `AppLayer` to a +// listening socket instead. We wrap `dispose` to also close the DB / MCP store. +export const makeSelfHostApiHandler = async ( + options: MakeSelfHostAppOptions = {}, +): Promise => { + const { toWebHandler, closeDb } = await makeSelfHostApp(options); + const web = toWebHandler(); + return { + handler: web.handler, + dispose: async () => { + await web.dispose(); + await closeDb(); + }, + }; +}; diff --git a/apps/host-selfhost/src/auth/better-auth.test.ts b/apps/host-selfhost/src/auth/better-auth.test.ts new file mode 100644 index 000000000..7037a8ab2 --- /dev/null +++ b/apps/host-selfhost/src/auth/better-auth.test.ts @@ -0,0 +1,84 @@ +import { mkdtempSync } from "node:fs"; +import { tmpdir } from "node:os"; +import { join } from "node:path"; + +import { afterAll, expect, test } from "@effect/vitest"; + +// Real Better Auth path: set a secret + bootstrap admin before importing. +process.env.EXECUTOR_DATA_DIR = mkdtempSync(join(tmpdir(), "eh-auth-")); +process.env.BETTER_AUTH_SECRET = "test-secret-0123456789-abcdefghijklmnop-qrstuv"; +process.env.EXECUTOR_BOOTSTRAP_ADMIN_EMAIL = "admin@test.local"; +process.env.EXECUTOR_BOOTSTRAP_ADMIN_PASSWORD = "admin-password-123"; + +const { makeSelfHostApiHandler } = await import("../app"); + +const { handler, dispose } = await makeSelfHostApiHandler(); +afterAll(() => dispose()); + +const BASE = "http://localhost:4788"; + +test("migrations create both the Better Auth and FumaDB executor schema regions", async () => { + // Open a SEPARATE libSQL connection to the same file Better Auth (via its own + // LibsqlDialect connection) and the FumaDB drizzle client wrote to. That this + // connection can read Better Auth's tables AND rows proves the cross-connection + // invariant: there is no shared in-process handle anymore, yet a row Better + // Auth wrote is immediately visible here on the same file: URL. + const { createClient } = await import("@libsql/client"); + const db = createClient({ url: `file:${join(process.env.EXECUTOR_DATA_DIR!, "data.db")}` }); + const names = (await db.execute("SELECT name FROM sqlite_master WHERE type='table'")).rows.map( + // oxlint-disable-next-line executor/no-redundant-primitive-cast -- boundary: sqlite_master.name is TEXT; narrow libSQL's SQLValue to string for the table-name list + (r) => r.name as string, + ); + // Better Auth tables + for (const t of ["user", "session", "account", "organization", "member"]) { + expect(names).toContain(t); + } + // FumaDB executor tables coexist in the same file + expect(names).toContain("secret"); + + // CROSS-CONNECTION PROOF: the bootstrap admin Better Auth wrote through its + // LibsqlDialect connection is readable through this independent connection. + // oxlint-disable-next-line executor/no-double-cast -- boundary: the SELECT column is the schema contract for the Better Auth `user` row read off this independent libSQL connection + const admin = ( + await db.execute({ + sql: "SELECT email FROM user WHERE email = ?", + args: ["admin@test.local"], + }) + ).rows[0] as unknown as { email: string } | undefined; + expect(admin?.email).toBe("admin@test.local"); + db.close(); +}); + +test("sign-up issues a bearer token and resolves to a per-user org-pinned scope", async () => { + const signUp = await handler( + new Request(`${BASE}/api/auth/sign-up/email`, { + method: "POST", + headers: { "content-type": "application/json" }, + body: JSON.stringify({ + email: "member@test.local", + password: "member-password-123", + name: "Member", + }), + }), + ); + expect(signUp.status).toBe(200); + const token = signUp.headers.get("set-auth-token"); + expect(token).toBeTruthy(); + + const scoped = await handler( + new Request("http://localhost/api/scope", { headers: { authorization: `Bearer ${token}` } }), + ); + expect(scoped.status).toBe(200); + const body = (await scoped.json()) as { id: string; stack: ReadonlyArray<{ id: string }> }; + expect(body.stack.length).toBe(2); + const inner = body.stack[0]!; + const outer = body.stack[1]!; + expect(outer.id).toBe(body.id); + expect(inner.id.startsWith("user-org:")).toBe(true); + expect(inner.id.endsWith(`:${outer.id}`)).toBe(true); +}); + +test("an unauthenticated request is rejected with 401", async () => { + const res = await handler(new Request("http://localhost/api/scope")); + expect(res.status).toBe(401); +}); diff --git a/apps/host-selfhost/src/auth/better-auth.ts b/apps/host-selfhost/src/auth/better-auth.ts new file mode 100644 index 000000000..ad7f8886d --- /dev/null +++ b/apps/host-selfhost/src/auth/better-auth.ts @@ -0,0 +1,128 @@ +import { betterAuth, type BetterAuthOptions } from "better-auth"; +import { admin, bearer, mcp, organization } from "better-auth/plugins"; +import { apiKey } from "@better-auth/api-key"; +import { type Client } from "@libsql/client"; +import { LibsqlDialect } from "@libsql/kysely-libsql"; +import { Context } from "effect"; + +import { loadConfig } from "../config"; +import { seedOrgAndAdmin } from "./seed"; + +// --------------------------------------------------------------------------- +// Better Auth instance over the SAME libSQL `file:` URL as the FumaDB executor +// tables ("one file, two schema regions"). +// +// Schema-at-boot: passing `{ dialect: new LibsqlDialect({ url }), type: "sqlite" }` +// makes Better Auth's createKyselyAdapter take its `"dialect" in db` branch (no +// native dep, no bun:sqlite); `runMigrations()` creates the auth tables +// idempotently in that file. `makeAuthOptions` is the single source of truth so +// the migrator and runtime instance never drift. +// +// CRITICAL: LibsqlDialect opens its OWN libSQL connection to the file — it does +// NOT share SelfHostDb's drizzle connection. Both target one file, and a row +// Better Auth writes via this dialect is immediately readable through the +// drizzle/FumaDB client (proven by seed.ts's reads + better-auth.test.ts). The +// per-connection foreign_keys/WAL PRAGMAs SelfHostDb set on its own connection +// do NOT carry to this one; for the auth tables that is fine (Kysely issues no +// FK-dependent reads at boot and WAL is already a file-level mode), and the +// shared file stays consistent because writes go through SQLite's file lock. +// +// NEVER call .destroy() on the resulting Kysely instance during normal +// operation — SelfHostDb owns the file lifecycle and closes its client at +// shutdown; the dialect's connection is GC'd with the auth instance. +// +// `satisfies BetterAuthOptions` (not a return annotation) keeps the literal +// plugin tuple so `betterAuth` infers the plugin-augmented `auth.api` and +// session/user shapes (activeOrganizationId, role, createUser, ...). +// --------------------------------------------------------------------------- + +const makeAuthOptions = (url: string, organizationId: string) => { + const config = loadConfig(); + const secret = config.authSecret; + if (!secret || secret.length < 32) { + // oxlint-disable-next-line executor/no-try-catch-or-throw, executor/no-error-constructor -- boundary: a multi-user auth server must not boot without a strong session secret + throw new Error("BETTER_AUTH_SECRET (or AUTH_SECRET) must be set and at least 32 characters"); + } + return { + database: { dialect: new LibsqlDialect({ url }), type: "sqlite" as const }, + secret, + baseURL: config.webBaseUrl, + // The browser Origin must match this exactly; CLI/MCP bearer requests carry + // no Origin and are unaffected. + trustedOrigins: [config.webBaseUrl], + emailAndPassword: { enabled: true }, + // `apiKey` issues long-lived personal keys (the API-keys page). With + // `enableSessionForAPIKeys`, presenting a key resolves to its owner's + // session — so a key works as a Bearer token for the API + MCP endpoint. + // + // `mcp()` adds the MCP OAuth Authorization Server: dynamic client + // registration + authorize + token under /api/auth/mcp/*, the discovery + // docs, and `getMcpSession` (opaque-bearer validation). It WRAPS + // oidcProvider — do NOT also add oidcProvider. The two root well-known docs + // are re-emitted by the shared envelope (MCP clients probe the origin root, + // not the /api/auth basePath). + plugins: [ + organization(), + admin(), + apiKey({ enableSessionForAPIKeys: true }), + bearer(), + mcp({ loginPage: "/login" }), + ], + databaseHooks: { + session: { + create: { + // Single-org instance: pin every session to the one organization, so + // every authenticated user resolves to the org scope. (Membership + // rows are only created for the bootstrap admin via createOrganization; + // the pin — not a member row — is what scope derivation reads.) + before: async (session: Record) => ({ + data: { ...session, activeOrganizationId: organizationId }, + }), + }, + }, + }, + } satisfies BetterAuthOptions; +}; + +const createAuthInstance = (url: string, organizationId: string) => + betterAuth(makeAuthOptions(url, organizationId)); + +export type Auth = ReturnType; + +export interface BetterAuthHandle { + readonly auth: Auth; + readonly organizationId: string; + readonly organizationName: string; + readonly handler: (request: Request) => Promise; +} + +export class BetterAuth extends Context.Service()( + "@executor-js/host-selfhost/BetterAuth", +) {} + +/** + * Build the Better Auth instance: migrate, seed the org+admin, then rebuild + * with the resolved org id pinned into the session hook. runMigrations and the + * seed are idempotent, so this is safe on every boot. + * + * `url` is the SAME libSQL `file:` URL SelfHostDb opened; `client` is + * SelfHostDb's drizzle connection to that file, used by the seed for its two + * idempotency reads against the auth tables Better Auth just migrated (proving + * the cross-connection invariant: Better Auth writes via LibsqlDialect are + * visible through SelfHostDb's client on the same file). + */ +export const buildBetterAuth = async (url: string, client: Client): Promise => { + const config = loadConfig(); + + // Phase 1: bootstrap instance (placeholder org), create tables, seed. + // `runMigrations()` flows through the LibsqlDialect and is idempotent. + const bootstrap = createAuthInstance(url, ""); + await (await bootstrap.$context).runMigrations(); + const { organizationId, organizationName } = await seedOrgAndAdmin(bootstrap, client, config); + + // Phase 2: rebuild with the real org id so the session-pin hook is correct. + // Migrations are already applied; this instance opens its own dialect + // connection to the same file. + const auth = createAuthInstance(url, organizationId); + return { auth, organizationId, organizationName, handler: auth.handler }; +}; diff --git a/apps/host-selfhost/src/auth/identity.ts b/apps/host-selfhost/src/auth/identity.ts new file mode 100644 index 000000000..b75685b99 --- /dev/null +++ b/apps/host-selfhost/src/auth/identity.ts @@ -0,0 +1,84 @@ +import { Effect, Layer } from "effect"; + +import { IdentityProvider, Unauthorized } from "@executor-js/api/server"; + +import { BetterAuth } from "./better-auth"; + +// --------------------------------------------------------------------------- +// The self-host identity seam — the production implementation of the shared +// `IdentityProvider` from `@executor-js/api/server`, which resolves an incoming +// request to a Principal. WorkOS (cloud) and Better Auth (self-host) are +// interchangeable implementations of the same tag; nothing downstream knows +// which is wired. +// +// - succeeds with a Principal -> authenticated +// - fails Unauthorized -> no/invalid credential (renders 401) +// - fails NoOrganization -> valid credential, no org (renders 403) +// +// `betterAuthIdentityLayer` is the only production provider. The trivial fake +// identities tests inject live in `src/testing/test-app.ts`. +// --------------------------------------------------------------------------- + +const bearerToken = (headers: Headers): string | undefined => { + const authorization = headers.get("authorization"); + if (!authorization) return undefined; + return authorization.toLowerCase().startsWith("bearer ") + ? authorization.slice(7).trim() || undefined + : undefined; +}; + +// --------------------------------------------------------------------------- +// The production IdentityProvider: resolve a request to a Better Auth session +// and map it to a neutral Principal. Three credential shapes resolve here: +// - session cookie (browser SPA) +// - Bearer session token (bearer plugin) +// - Bearer API key — the apiKey plugin reads `x-api-key`, so when the normal +// resolution fails we retry with the Bearer value as x-api-key, which (with +// enableSessionForAPIKeys) mints the owner's session. This is what lets a +// generated API key authenticate the API + MCP endpoint as a Bearer token. +// Single-org instance, so organizationName is the boot-cached org name. +// --------------------------------------------------------------------------- + +export const betterAuthIdentityLayer: Layer.Layer = + Layer.effect(IdentityProvider)( + Effect.gen(function* () { + const { auth, organizationId, organizationName } = yield* BetterAuth; + return IdentityProvider.of({ + authenticate: (request) => + Effect.gen(function* () { + let resolved = yield* Effect.promise(() => + auth.api.getSession({ headers: request.headers }), + ); + if (!resolved) { + const token = bearerToken(request.headers); + if (token) { + resolved = yield* Effect.tryPromise({ + try: () => auth.api.getSession({ headers: { "x-api-key": token } }), + catch: () => "api-key session lookup failed", + }).pipe(Effect.orElseSucceed(() => null)); + } + } + // No session resolved from any credential shape -> unauthenticated. + // The middleware's failure strategy renders this as a 401. + if (!resolved) return yield* new Unauthorized(); + // Single-org instance: every authenticated user belongs to the one + // seeded org. Cookie/bearer-session logins are pinned to it by the + // session hook; API-key-minted sessions carry no active org, so we + // default to the seeded org rather than rejecting with NoOrganization. + const resolvedOrganizationId = resolved.session.activeOrganizationId ?? organizationId; + return { + accountId: resolved.user.id, + organizationId: resolvedOrganizationId, + organizationName, + email: resolved.user.email, + name: resolved.user.name ?? null, + avatarUrl: resolved.user.image ?? null, + roles: (resolved.user.role ?? "user") + .split(",") + .map((role) => role.trim()) + .filter((role) => role.length > 0), + }; + }), + }); + }), + ); diff --git a/apps/host-selfhost/src/auth/index.ts b/apps/host-selfhost/src/auth/index.ts new file mode 100644 index 000000000..63c2e81ae --- /dev/null +++ b/apps/host-selfhost/src/auth/index.ts @@ -0,0 +1,45 @@ +import { Layer } from "effect"; + +import { IdentityProvider } from "@executor-js/api/server"; + +import type { SelfHostDbHandle } from "../db/self-host-db"; +import { BetterAuth, buildBetterAuth, type BetterAuthHandle } from "./better-auth"; +import { betterAuthIdentityLayer } from "./identity"; + +export { BetterAuth, buildBetterAuth, type BetterAuthHandle } from "./better-auth"; +export { betterAuthIdentityLayer } from "./identity"; + +// --------------------------------------------------------------------------- +// Resolve the self-host auth providers. +// +// Build the Better Auth instance over the shared libSQL file, expose its +// `IdentityProvider` (cookie/bearer/api-key) and its web handler (mounted at +// /api/auth/*). Returns the live `BetterAuthHandle` so the composition root can +// build the account API and the Better Auth MCP OAuth seam. +// +// This is the one and only production auth path. Tests that need a fake identity +// (single-admin / header-driven) compose `ExecutorApp.make` directly through +// `makeSelfHostTestApp` (src/testing/test-app.ts) rather than passing through +// here, so this resolution is unconditional. +// --------------------------------------------------------------------------- + +export interface ResolvedAuthProviders { + /** The resolved Better Auth `IdentityProvider` seam (cookie/bearer/api-key). */ + readonly identityLayer: Layer.Layer; + /** Better Auth's web handler (`/api/auth/*`). */ + readonly authHandler: (request: Request) => Promise; + /** The live Better Auth handle (account API + Better Auth MCP OAuth seam). */ + readonly betterAuth: BetterAuthHandle; +} + +export const resolveAuthProviders = async ( + dbHandle: SelfHostDbHandle, +): Promise => { + const betterAuth = await buildBetterAuth(dbHandle.url, dbHandle.client); + const betterAuthLayer = Layer.succeed(BetterAuth)(betterAuth); + return { + identityLayer: betterAuthIdentityLayer.pipe(Layer.provide(betterAuthLayer)), + authHandler: betterAuth.handler, + betterAuth, + }; +}; diff --git a/apps/host-selfhost/src/auth/seed.ts b/apps/host-selfhost/src/auth/seed.ts new file mode 100644 index 000000000..51ffd6c2e --- /dev/null +++ b/apps/host-selfhost/src/auth/seed.ts @@ -0,0 +1,67 @@ +import { randomBytes } from "node:crypto"; + +import type { Client } from "@libsql/client"; + +import type { SelfHostConfig } from "../config"; +import type { Auth } from "./better-auth"; + +// --------------------------------------------------------------------------- +// Idempotent first-boot bootstrap: ensure the single organization and a +// bootstrap admin exist. Uses server-side auth.api calls (no session, no CLI) +// and queries the freshly-migrated Better Auth tables directly (through +// SelfHostDb's libSQL client — the SAME file Better Auth migrated, proving the +// cross-connection invariant) to stay idempotent across restarts. Returns the +// resolved org id/name, which the session-pin hook and the AuthProvider's +// org-name cache read. +// --------------------------------------------------------------------------- + +export const seedOrgAndAdmin = async ( + auth: Auth, + client: Client, + config: SelfHostConfig, +): Promise<{ organizationId: string; organizationName: string }> => { + const adminEmail = config.bootstrapAdminEmail ?? "admin@localhost"; + + // 1. Bootstrap admin (idempotent: look up by email first). + // oxlint-disable-next-line executor/no-double-cast -- boundary: the SELECT column is the schema contract for the Better Auth `user` row read off the libSQL client + const existingUser = ( + await client.execute({ sql: "SELECT id FROM user WHERE email = ?", args: [adminEmail] }) + ).rows[0] as unknown as { id: string } | undefined; + let adminId = existingUser?.id; + if (!adminId) { + const password = config.bootstrapAdminPassword ?? randomBytes(18).toString("base64url"); + const created = await auth.api.createUser({ + body: { email: adminEmail, password, name: config.bootstrapAdminName, role: "admin" }, + }); + adminId = created.user.id; + if (!config.bootstrapAdminPassword) { + console.warn( + `[executor] created bootstrap admin "${adminEmail}" with a generated password: ${password}\n` + + `[executor] set EXECUTOR_BOOTSTRAP_ADMIN_PASSWORD to choose your own and silence this.`, + ); + } + } + + // 2. The single organization (idempotent: look up by slug first). + // oxlint-disable-next-line executor/no-double-cast -- boundary: the SELECT columns are the schema contract for the Better Auth `organization` row read off the libSQL client + const existingOrg = ( + await client.execute({ + sql: "SELECT id, name FROM organization WHERE slug = ?", + args: [config.orgSlug], + }) + ).rows[0] as unknown as { id: string; name: string } | undefined; + if (existingOrg) { + return { organizationId: existingOrg.id, organizationName: existingOrg.name }; + } + + // System action: pass userId so the org is created with no session and the + // admin becomes its owner (creates the membership row). + const org = await auth.api.createOrganization({ + body: { name: config.organizationName, slug: config.orgSlug, userId: adminId }, + }); + if (!org) { + // oxlint-disable-next-line executor/no-try-catch-or-throw, executor/no-error-constructor -- boundary: org creation must succeed for a usable instance + throw new Error("Failed to create the bootstrap organization"); + } + return { organizationId: org.id, organizationName: config.organizationName }; +}; diff --git a/apps/host-selfhost/src/boot.test.ts b/apps/host-selfhost/src/boot.test.ts new file mode 100644 index 000000000..4a29bc09a --- /dev/null +++ b/apps/host-selfhost/src/boot.test.ts @@ -0,0 +1,43 @@ +import { mkdtempSync } from "node:fs"; +import { tmpdir } from "node:os"; +import { join } from "node:path"; + +import { afterAll, expect, test } from "@effect/vitest"; + +// Config reads the environment, so point it at a throwaway data dir before +// importing the app graph. +process.env.EXECUTOR_DATA_DIR = mkdtempSync(join(tmpdir(), "eh-boot-")); + +const { makeSelfHostTestApp, singleAdminIdentityLayer } = await import("./testing/test-app"); + +const { handler, dispose } = await makeSelfHostTestApp({ + identity: singleAdminIdentityLayer({ + userId: "admin", + organizationId: "default-org", + organizationName: "Default", + }), +}); +afterAll(() => dispose()); + +test("GET /scope returns the single-admin org scope stack", async () => { + const res = await handler(new Request("http://localhost/api/scope")); + expect(res.status).toBe(200); + const body = (await res.json()) as { id: string; stack: ReadonlyArray<{ id: string }> }; + expect(body.id).toBe("default-org"); + expect(body.stack.map((s) => s.id)).toEqual(["user-org:admin:default-org", "default-org"]); +}); + +test("POST /executions runs code in the QuickJS sandbox", async () => { + const res = await handler( + new Request("http://localhost/api/executions", { + method: "POST", + headers: { "content-type": "application/json" }, + body: JSON.stringify({ code: "export default 6 * 7" }), + }), + ); + expect(res.status).toBe(200); + const body = (await res.json()) as { status: string; text: string; isError: boolean }; + expect(body.status).toBe("completed"); + expect(body.text).toBe("42"); + expect(body.isError).toBe(false); +}); diff --git a/apps/host-selfhost/src/config.ts b/apps/host-selfhost/src/config.ts new file mode 100644 index 000000000..bbd16294a --- /dev/null +++ b/apps/host-selfhost/src/config.ts @@ -0,0 +1,88 @@ +import { randomBytes } from "node:crypto"; +import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs"; +import { join } from "node:path"; + +// --------------------------------------------------------------------------- +// Self-host server config — a single typed surface parsed from the +// environment. Slice 1 keeps this a plain loader with safe defaults; it can +// graduate to Effect-Schema validation without changing call sites. +// --------------------------------------------------------------------------- + +export const SELF_HOST_NAMESPACE = "executor_selfhost"; +export const SELF_HOST_SCHEMA_VERSION = "1.0.0"; + +export interface SelfHostConfig { + /** Bind address. Defaults to loopback. */ + readonly host: string; + readonly port: number; + /** Absolute path to the SQLite database file. */ + readonly dbPath: string; + /** Public base URL used by core tools that build absolute links. */ + readonly webBaseUrl: string; + /** + * Whether sandboxed code may reach loopback/private network addresses. + * Defaults to false — adversarial LLM code should not hit the host's + * internal network unless an operator opts in. + */ + readonly allowLocalNetwork: boolean; + // Better Auth (slice 3). authSecret is undefined unless configured; the auth + // layer fails loud at boot if it is needed but missing/too short. + readonly authSecret: string | undefined; + readonly bootstrapAdminEmail: string | undefined; + readonly bootstrapAdminPassword: string | undefined; + readonly bootstrapAdminName: string; + /** The single organization every self-host user belongs to. */ + readonly organizationName: string; + readonly orgSlug: string; +} + +export const resolveDataDir = (): string => + process.env.EXECUTOR_DATA_DIR ?? join(process.cwd(), ".executor-selfhost"); + +let cachedSecretKey: string | undefined; + +/** + * Master key for the encrypted secret provider. Prefers EXECUTOR_SECRET_KEY; + * otherwise generates and persists a random key under the data dir on first + * boot (so a single-container deploy is encrypted-by-default without manual + * setup). Memoized so repeated per-request reads are cheap. + */ +export const resolveSecretKey = (): string => { + if (cachedSecretKey) return cachedSecretKey; + const fromEnv = process.env.EXECUTOR_SECRET_KEY?.trim(); + if (fromEnv) { + cachedSecretKey = fromEnv; + return fromEnv; + } + const keyPath = join(resolveDataDir(), "secret.key"); + if (existsSync(keyPath)) { + cachedSecretKey = readFileSync(keyPath, "utf8").trim(); + return cachedSecretKey; + } + mkdirSync(resolveDataDir(), { recursive: true }); + const generated = randomBytes(32).toString("base64"); + writeFileSync(keyPath, generated, { mode: 0o600 }); + console.warn( + `[executor] generated a secret-encryption key at ${keyPath}. Set EXECUTOR_SECRET_KEY to manage it explicitly (and to keep secrets readable across data-dir changes).`, + ); + cachedSecretKey = generated; + return generated; +}; + +export const loadConfig = (): SelfHostConfig => { + const port = Number.parseInt(process.env.PORT ?? "4788", 10); + const dataDir = resolveDataDir(); + return { + host: process.env.EXECUTOR_HOST ?? "127.0.0.1", + port, + dbPath: process.env.EXECUTOR_DB_PATH ?? join(dataDir, "data.db"), + webBaseUrl: process.env.EXECUTOR_WEB_BASE_URL ?? `http://localhost:${port}`, + allowLocalNetwork: process.env.EXECUTOR_ALLOW_LOCAL_NETWORK === "true", + authSecret: process.env.BETTER_AUTH_SECRET ?? process.env.AUTH_SECRET, + bootstrapAdminEmail: process.env.EXECUTOR_BOOTSTRAP_ADMIN_EMAIL, + bootstrapAdminPassword: process.env.EXECUTOR_BOOTSTRAP_ADMIN_PASSWORD, + bootstrapAdminName: process.env.EXECUTOR_BOOTSTRAP_ADMIN_NAME ?? "Admin", + organizationName: process.env.EXECUTOR_ORG_NAME ?? "Default", + orgSlug: process.env.EXECUTOR_ORG_SLUG ?? "default", + }; +}; diff --git a/apps/host-selfhost/src/db/self-host-db.ts b/apps/host-selfhost/src/db/self-host-db.ts new file mode 100644 index 000000000..339d9ec74 --- /dev/null +++ b/apps/host-selfhost/src/db/self-host-db.ts @@ -0,0 +1,179 @@ +import { mkdirSync } from "node:fs"; +import { dirname, resolve } from "node:path"; + +import { createClient, type Client } from "@libsql/client"; +import { drizzle, type LibSQLDatabase } from "drizzle-orm/libsql"; +import { type FumaDB } from "fumadb"; +import { + createDrizzleRuntimeSchemaFromTables, + ensureDrizzleRuntimeSchemaFromTables, +} from "fumadb/adapters/drizzle"; +import { type schema as fumaSchema, type RelationsMap } from "fumadb/schema"; +import { Context, Effect, Layer } from "effect"; + +import { + collectTables, + createExecutorFumaDb, + DbProvider, + type ExecutorDbHandle, +} from "@executor-js/api/server"; +import type { FumaDb, FumaTables } from "@executor-js/sdk"; + +import { selfHostPlugins } from "../plugins"; +import { SELF_HOST_NAMESPACE, SELF_HOST_SCHEMA_VERSION } from "../config"; + +// --------------------------------------------------------------------------- +// SQLite executor DB factory, inline (like apps/local's sqlite-fumadb.ts and +// apps/cloud's fuma.ts — each app owns its DB wiring; there is no shared +// storage package). Differences from apps/local: busy_timeout + synchronous +// pragmas for the multi-user HTTP server, and the idempotent +// `ensureDrizzleRuntimeSchemaFromTables` schema-ensure (the drizzle adapter +// has no versioned migrator). Built ONCE for the process; the per-request +// executor reuses this long-lived handle's `db`. +// +// Driver: libSQL (@libsql/client + drizzle-orm/libsql), not bun:sqlite, so the +// self-host server runs on Node AND Bun (and the same code path serves edge by +// swapping the `file:` URL for an https Turso URL). Better Auth opens its OWN +// libSQL connection (LibsqlDialect) to the SAME file: URL — see better-auth.ts. +// Because libSQL connections are NOT a single shared in-process handle the way +// bun:sqlite's was, the WAL/busy_timeout/synchronous/foreign_keys PRAGMAs are +// re-applied PER connection (here, and again in the Better Auth dialect path). +// --------------------------------------------------------------------------- + +/** + * Build a `file:` libSQL URL from a filesystem path. libSQL requires an + * absolute path for `file:` URLs; `:memory:` passes through unchanged. + */ +export const toLibsqlFileUrl = (path: string): string => + path === ":memory:" ? path : `file:${resolve(path)}`; + +type SelfHostFumaSchema = ReturnType< + typeof fumaSchema> +>; + +export interface SelfHostDbHandle { + readonly db: FumaDb>; + readonly fuma: FumaDB[]>; + readonly drizzle: LibSQLDatabase>; + /** + * The libSQL client for this handle's `file:` URL. Better Auth opens its own + * separate connection to the same file via LibsqlDialect; the seed reads + * Better Auth's tables through this client (async), so the URL is carried + * alongside so callers can hand it to the dialect. + */ + readonly client: Client; + readonly url: string; + readonly close: () => Promise; +} + +export interface CreateSqliteExecutorDbOptions { + readonly tables: TTables; + readonly namespace: string; + readonly version?: string; + readonly path: string; +} + +export const createSqliteExecutorDb = async ( + options: CreateSqliteExecutorDbOptions, +): Promise> => { + const version = options.version ?? SELF_HOST_SCHEMA_VERSION; + if (options.path !== ":memory:") { + mkdirSync(dirname(options.path), { recursive: true }); + } + + const url = toLibsqlFileUrl(options.path); + const client = createClient({ url }); + // PER-CONNECTION PRAGMAs: libSQL gives drizzle and Better Auth SEPARATE + // connections to this file (no single shared handle), so these must be set on + // this connection here and again on Better Auth's dialect connection. WAL is a + // file-level mode once any connection enables it; foreign_keys is strictly + // per-connection and MUST be re-set on each. + await client.execute("PRAGMA foreign_keys = ON"); + await client.execute("PRAGMA journal_mode = WAL"); + // Survive concurrent writes from the multi-user HTTP server, and trade + // fsync-per-commit for fsync-per-checkpoint (durable under WAL). + await client.execute("PRAGMA busy_timeout = 5000"); + await client.execute("PRAGMA synchronous = NORMAL"); + + const schema = createDrizzleRuntimeSchemaFromTables({ + tables: options.tables, + namespace: options.namespace, + version, + provider: "sqlite", + }); + const drizzleDb = drizzle({ client, schema }); + + await ensureDrizzleRuntimeSchemaFromTables(drizzleDb, { + tables: options.tables, + namespace: options.namespace, + version, + provider: "sqlite", + }); + + const { db, fuma } = createExecutorFumaDb(drizzleDb, { + tables: options.tables, + namespace: options.namespace, + version, + provider: "sqlite", + }); + + return { + db, + fuma, + drizzle: drizzleDb, + client, + url, + close: async () => { + client.close(); + }, + }; +}; + +// --------------------------------------------------------------------------- +// Long-lived DB layer. Built once at boot; the connection lives for the +// process. The per-request executor (execution.ts) reuses this handle's `db` +// and only varies the scope stack — so "build once, rebind scope per request" +// is cheap. +// --------------------------------------------------------------------------- + +export class SelfHostDb extends Context.Service()( + "@executor-js/host-selfhost/SelfHostDb", +) {} + +export interface SelfHostDbLayerOptions { + readonly path: string; + readonly namespace?: string; + readonly version?: string; +} + +/** + * Open the self-host DB with the full plugin table set. Used both by the layer + * and by the composition root (which needs the raw handle eagerly so Better + * Auth can open its own libSQL connection to the same `file:` URL). + */ +export const createSelfHostDb = (options: SelfHostDbLayerOptions): Promise => + createSqliteExecutorDb({ + tables: collectTables(selfHostPlugins), + namespace: options.namespace ?? SELF_HOST_NAMESPACE, + version: options.version ?? SELF_HOST_SCHEMA_VERSION, + path: options.path, + }); + +// Shared DbProvider seam (P2a). The self-host handle keeps its libSQL driver, +// WAL/busy_timeout PRAGMAs, and the idempotent +// `ensureDrizzleRuntimeSchemaFromTables` bring-up; this just re-exposes the +// already-built long-lived handle under the shared `DbProvider` tag so the +// future shared `makeScopedExecutor` (P3) reads from one injection point. The +// release is owned by `SelfHostDb`, so this projection does not re-close. +export const SelfHostDbProvider: Layer.Layer = Layer.effect( + DbProvider, +)( + Effect.map( + SelfHostDb.asEffect(), + (handle): ExecutorDbHandle => ({ + db: handle.db, + fuma: handle.fuma, + close: handle.close, + }), + ), +); diff --git a/apps/host-selfhost/src/execution.ts b/apps/host-selfhost/src/execution.ts new file mode 100644 index 000000000..cf3dc1f57 --- /dev/null +++ b/apps/host-selfhost/src/execution.ts @@ -0,0 +1,80 @@ +import { Layer } from "effect"; + +import { + CodeExecutorProvider, + DbProvider, + EngineDecorator, + EngineDecoratorNoop, + HostConfig, + PluginsProvider, +} from "@executor-js/api/server"; +import { makeQuickJsExecutor } from "@executor-js/runtime-quickjs"; + +import executorConfig from "../executor.config"; +import { SelfHostDb, SelfHostDbProvider } from "./db/self-host-db"; +import { loadConfig } from "./config"; + +// --------------------------------------------------------------------------- +// Self-host execution-stack seams. +// +// The shared `makeExecutionStack` (@executor-js/api/server) owns the body: +// makeScopedExecutor -> createExecutionEngine -> EngineDecorator.decorate. +// Self-host just supplies the five seam Layers it reads from. Differences from +// cloud: the QuickJS in-process code substrate (vs the Cloudflare dynamic +// worker) and a NO-OP engine decorator (no usage metering). +// +// - DbProvider -> SelfHostDbProvider: projects the long-lived +// libSQL handle (built once at boot, see db/). The +// shared factory reads `db` per request without +// caching, so the long-lived lifetime is preserved. +// - PluginsProvider -> fresh `executor.config.ts#plugins()` per call, +// matching per-request plugin instances (avoids +// cross-request plugin state). +// - HostConfig -> `{ allowLocalNetwork, webBaseUrl }` from +// `loadConfig()`. +// - CodeExecutorProvider -> `makeQuickJsExecutor()`. +// - EngineDecorator -> no-op (self-host does not meter executions). +// --------------------------------------------------------------------------- + +export { makeExecutionStack } from "@executor-js/api/server"; + +export const SelfHostPluginsProvider: Layer.Layer = Layer.succeed(PluginsProvider)( + { + plugins: () => executorConfig.plugins(), + }, +); + +export const SelfHostHostConfig: Layer.Layer = Layer.sync(HostConfig, () => { + const config = loadConfig(); + return { + allowLocalNetwork: config.allowLocalNetwork, + webBaseUrl: config.webBaseUrl, + }; +}); + +export const SelfHostCodeExecutorProvider: Layer.Layer = Layer.sync( + CodeExecutorProvider, + () => makeQuickJsExecutor(), +); + +/** + * The `makeScopedExecutor` seams (`DbProvider` + `PluginsProvider` + + * `HostConfig`) over the long-lived `SelfHostDb`. Shared between the production + * `SelfHostExecutionStackLayer` and the `makeScopedExecutor` test entrypoint. + */ +export const SelfHostScopedExecutorSeams: Layer.Layer< + DbProvider | PluginsProvider | HostConfig, + never, + SelfHostDb +> = Layer.mergeAll(SelfHostDbProvider, SelfHostPluginsProvider, SelfHostHostConfig); + +/** + * The five execution-stack seams the shared `makeExecutionStack` reads from, + * bundled into one Layer. Requires the long-lived `SelfHostDb` (provided once at + * boot); the per-request executor only varies the scope stack. + */ +export const SelfHostExecutionStackLayer: Layer.Layer< + DbProvider | PluginsProvider | HostConfig | CodeExecutorProvider | EngineDecorator, + never, + SelfHostDb +> = Layer.mergeAll(SelfHostScopedExecutorSeams, SelfHostCodeExecutorProvider, EngineDecoratorNoop); diff --git a/apps/host-selfhost/src/index.ts b/apps/host-selfhost/src/index.ts new file mode 100644 index 000000000..ee92a0b34 --- /dev/null +++ b/apps/host-selfhost/src/index.ts @@ -0,0 +1,9 @@ +export { startServer } from "./serve"; +export { + makeSelfHostApp, + makeSelfHostApiHandler, + type SelfHostApiHandler, + type MakeSelfHostAppOptions, +} from "./app"; +export { loadConfig, type SelfHostConfig } from "./config"; +export { BetterAuth, buildBetterAuth, betterAuthIdentityLayer } from "./auth"; diff --git a/apps/host-selfhost/src/mcp/auth.ts b/apps/host-selfhost/src/mcp/auth.ts new file mode 100644 index 000000000..31c435234 --- /dev/null +++ b/apps/host-selfhost/src/mcp/auth.ts @@ -0,0 +1,180 @@ +import { Effect, Layer } from "effect"; +import { oAuthDiscoveryMetadata, oAuthProtectedResourceMetadata } from "better-auth/plugins"; + +import { IdentityProvider } from "@executor-js/api/server"; +import { + authenticated, + McpAuthProvider, + unauthorized, + type AuthOutcome, + type McpDiscoveryRoute, + type Principal, +} from "@executor-js/host-mcp"; + +import { BetterAuth } from "../auth/better-auth"; + +// --------------------------------------------------------------------------- +// Self-host McpAuthProvider adapter, backed by Better Auth's mcp() plugin. +// +// Responsibilities the envelope needs: +// +// 1. DECLARE the discovery routes it owns. MCP clients probe the true origin +// ROOT, but Better Auth's handler only mounts the well-known docs under +// /api/auth/.well-known/*, so we re-emit BOTH docs at the bare origin root +// via the plugin's helpers. The envelope registers a GET for each declared +// path. +// +// 2. `resourceMetadataUrl(request)` — the absolute `resource_metadata` URL the +// 401 challenge points at: the bare origin-root protected-resource doc +// (`/.well-known/oauth-protected-resource`). +// +// 3. `authenticate(request)` resolving an MCP principal as a typed AuthOutcome, +// trying two credential shapes in order: +// a. The mcp() OAuth opaque bearer (getMcpSession) — ONLY when an +// `Authorization: Bearer …` header is present (avoids a getMcpSession +// round-trip on every cookie request). getMcpSession does NOT validate +// `accessTokenExpiresAt`, so we ENFORCE expiry ourselves before +// accepting it, then enrich the bare {userId} into a full principal. +// b. The existing IdentityProvider path (session cookie / bearer-session / +// x-api-key) — preserves API-key Bearer access for the API + MCP. +// Anything that fails or yields nothing collapses to `Unauthorized`; the +// envelope renders the 401 + challenge. Self-host always has an org, so it +// never returns Forbidden/Unavailable. +// +// The OAuth endpoints themselves (/api/auth/mcp/{register,authorize,token}) +// stay on the Better Auth handler mounted at /api/auth — NOT in this seam. +// --------------------------------------------------------------------------- + +const PROTECTED_RESOURCE_METADATA_PATH = "/.well-known/oauth-protected-resource"; +const AUTHORIZATION_SERVER_METADATA_PATH = "/.well-known/oauth-authorization-server"; + +const parseRoles = (role: string | null | undefined): ReadonlyArray => + (role ?? "user") + .split(",") + .map((r) => r.trim()) + .filter((r) => r.length > 0); + +/** + * The admin plugin's `role` column is populated at runtime but isn't part of + * Better Auth's static base-user type, so read it through a single typed view. + */ +const userRole = (user: object): string | null => { + const role = (user as { readonly role?: unknown }).role; + return typeof role === "string" ? role : null; +}; + +const hasBearer = (request: Request): boolean => + (request.headers.get("authorization") ?? "").startsWith("Bearer "); + +/** + * Absolute protected-resource metadata URL for the 401 challenge. Derive the + * origin from `baseURL` when set; otherwise from the live request so the URL is + * never relative (cloud-drop-in: a self-host behind any host resolves right). + */ +const resourceMetadataUrlFor = (baseURL: string | undefined, request: Request): string => { + const origin = baseURL && baseURL.length > 0 ? baseURL : new URL(request.url).origin; + return `${origin}${PROTECTED_RESOURCE_METADATA_PATH}`; +}; + +export const selfHostMcpAuth: Layer.Layer = + Layer.effect( + McpAuthProvider, + Effect.gen(function* () { + const { auth, organizationId, organizationName } = yield* BetterAuth; + const fallback = yield* IdentityProvider; + + const asMetadata = oAuthDiscoveryMetadata(auth); + const prMetadata = oAuthProtectedResourceMetadata(auth); + + const baseURL = auth.options.baseURL; + const resourceMetadataUrl = (request: Request): string => + resourceMetadataUrlFor(baseURL, request); + + // RFC 9728 challenge string carried on the Unauthorized outcome. Same shape + // as the envelope's default; we supply it explicitly to keep the 401's + // `WWW-Authenticate` fully owned by the provider. + const challengeFor = (request: Request): string => + `Bearer resource_metadata="${resourceMetadataUrl(request)}"`; + + const discoveryRoutes: ReadonlyArray = [ + { + path: PROTECTED_RESOURCE_METADATA_PATH, + handler: (request) => Effect.promise(() => prMetadata(request)), + }, + { + path: AUTHORIZATION_SERVER_METADATA_PATH, + handler: (request) => Effect.promise(() => asMetadata(request)), + }, + ]; + + // Resolved once; `internalAdapter.findUserById` enriches an OAuth userId. + const context = yield* Effect.promise(() => auth.$context); + + /** Enrich a bare OAuth `userId` into the full provider-neutral principal. */ + const principalFromUserId = (userId: string): Effect.Effect => + Effect.gen(function* () { + const user = yield* Effect.promise(() => context.internalAdapter.findUserById(userId)); + if (!user) return null; + return { + accountId: user.id, + // Single-org self-host: OAuth tokens carry no active org, so pin to + // the seeded org (same default as the cookie/api-key path). + organizationId, + organizationName, + email: user.email ?? "", + name: user.name ?? null, + avatarUrl: user.image ?? null, + roles: parseRoles(userRole(user)), + } satisfies Principal; + }); + + /** (a) The mcp() OAuth opaque bearer, with self-enforced expiry. */ + const authenticateOAuthBearer = (request: Request): Effect.Effect => + Effect.gen(function* () { + const session = yield* Effect.promise(() => + auth.api.getMcpSession({ headers: request.headers }), + ); + if (!session) return null; + // GOTCHA: getMcpSession does NOT validate accessTokenExpiresAt — an + // expired token still resolves. Reject it here. + if (new Date(session.accessTokenExpiresAt).getTime() < Date.now()) return null; + return yield* principalFromUserId(session.userId); + }).pipe(Effect.orElseSucceed(() => null)); + + /** (b) The existing cookie / bearer-session / x-api-key path. The fallback's + * api `Principal` shape is byte-identical to host-mcp's `Principal`. */ + const authenticateSession = (request: Request): Effect.Effect => + fallback.authenticate(request).pipe( + Effect.catchTags({ + Unauthorized: () => Effect.succeed(null), + NoOrganization: () => Effect.succeed(null), + }), + ); + + /** + * Try the OAuth bearer ONLY when a Bearer header is present (no + * getMcpSession round-trip on cookie requests), then the cookie/api-key + * fallback. Self-host always pins an org, so the outcome is always + * Authenticated or Unauthorized. + */ + const authenticate = (request: Request): Effect.Effect => + (hasBearer(request) + ? authenticateOAuthBearer(request).pipe( + Effect.flatMap((principal) => + principal ? Effect.succeed(principal) : authenticateSession(request), + ), + ) + : authenticateSession(request) + ).pipe( + Effect.map((principal) => + principal ? authenticated(principal) : unauthorized(challengeFor(request)), + ), + ); + + return { + discoveryRoutes, + resourceMetadataUrl, + authenticate, + }; + }), + ); diff --git a/apps/host-selfhost/src/mcp/index.ts b/apps/host-selfhost/src/mcp/index.ts new file mode 100644 index 000000000..f6b212c87 --- /dev/null +++ b/apps/host-selfhost/src/mcp/index.ts @@ -0,0 +1,78 @@ +import { Layer } from "effect"; + +import { IdentityProvider } from "@executor-js/api/server"; +import type { McpAuthProvider, McpErrorReporter, McpSessionStore } from "@executor-js/host-mcp"; + +import { BetterAuth, type BetterAuthHandle } from "../auth/better-auth"; +import type { SelfHostDbHandle } from "../db/self-host-db"; +import { selfHostMcpAuth } from "./auth"; +import { + makeSelfHostMcpSessionStore, + selfHostMcpReporter, + selfHostMcpSessions, +} from "./session-store"; + +export { selfHostMcpAuth } from "./auth"; +export { + makeSelfHostMcpSessionStore, + selfHostMcpReporter, + selfHostMcpSessions, + McpEngineBuildError, +} from "./session-store"; + +// --------------------------------------------------------------------------- +// The self-host MCP serving seams, fed to `ExecutorApp.make`'s `mcp` group. +// +// `ExecutorApp.make` mounts the shared, provider-neutral MCP serving envelope +// from @executor-js/host-mcp (the two root OAuth discovery docs + the multi-user +// /mcp endpoint, top-level per the ecosystem convention). The envelope does its +// own auth + session handling and is mounted OUTSIDE the API's execution +// middleware, like /api/auth. +// +// Self-host provides the TWO envelope seams plus an error-reporter override: +// - McpAuthProvider -> `selfHostMcpAuth` (Better Auth mcp() OAuth). It still +// requires `IdentityProvider`, which `make` provides from +// the resolved identity seam. +// - McpSessionStore -> `selfHostMcpSessions`: in-process Map. The store owns +// dispatch (create + forward + ownership) and builds its +// engine internally over the shared SelfHostDb. +// - McpErrorReporter -> `selfHostMcpReporter`: route 500 defects through the +// host's console capture. +// +// The OAuth endpoints (/api/auth/mcp/{register,authorize,token}) stay on the +// Better Auth handler mounted at /api/auth — not in the envelope. +// --------------------------------------------------------------------------- + +export interface SelfHostMcpSeams { + /** Resolve a request to an MCP `AuthOutcome` + declare the discovery routes. */ + readonly auth: Layer.Layer; + /** The in-process session store seam (dispatch + lifetime). */ + readonly sessions: Layer.Layer; + /** Route 500 defects through the host's console `ErrorCapture`. */ + readonly reporter: Layer.Layer; + /** Dispose all live in-process MCP sessions at shutdown (not a seam). */ + readonly close: () => Promise; +} + +/** + * Build the self-host MCP serving seams over the long-lived DB handle. The auth + * seam is `selfHostMcpAuth` (Better Auth mcp() OAuth), with the Better Auth + * instance provided; it still requires `IdentityProvider` from the resolved + * identity seam. Returns the three seam Layers plus the `close()` lifetime hook + * the app wires into shutdown. + */ +export const makeSelfHostMcpSeams = ( + dbHandle: SelfHostDbHandle, + betterAuth: BetterAuthHandle, +): SelfHostMcpSeams => { + const sessionStore = makeSelfHostMcpSessionStore(dbHandle); + const auth: Layer.Layer = selfHostMcpAuth.pipe( + Layer.provide(Layer.succeed(BetterAuth)(betterAuth)), + ); + return { + auth, + sessions: selfHostMcpSessions(sessionStore), + reporter: selfHostMcpReporter, + close: sessionStore.close, + }; +}; diff --git a/apps/host-selfhost/src/mcp/mcp-oauth.test.ts b/apps/host-selfhost/src/mcp/mcp-oauth.test.ts new file mode 100644 index 000000000..f9493a3aa --- /dev/null +++ b/apps/host-selfhost/src/mcp/mcp-oauth.test.ts @@ -0,0 +1,160 @@ +import { mkdtempSync } from "node:fs"; +import { tmpdir } from "node:os"; +import { join } from "node:path"; + +import { afterAll, expect, test } from "@effect/vitest"; + +process.env.EXECUTOR_DATA_DIR = mkdtempSync(join(tmpdir(), "eh-env-")); +process.env.BETTER_AUTH_SECRET = "env-test-secret-0123456789-abcdefghij-klmnop"; +process.env.EXECUTOR_BOOTSTRAP_ADMIN_EMAIL = "admin@env.test"; +process.env.EXECUTOR_BOOTSTRAP_ADMIN_PASSWORD = "admin-pass-123456"; + +const { makeSelfHostApiHandler } = await import("../app"); +const { handler, dispose } = await makeSelfHostApiHandler(); +afterAll(() => dispose()); + +const BASE = "http://localhost:4788"; + +test("serves OAuth Authorization Server metadata at the origin root", async () => { + const res = await handler(new Request(`${BASE}/.well-known/oauth-authorization-server`)); + expect(res.status).toBe(200); + const body = (await res.json()) as Record; + expect(body.issuer).toBeDefined(); + // mcp() advertises its DCR + authorize + token endpoints under /api/auth/mcp. + expect(String(body.authorization_endpoint)).toContain("/api/auth/mcp/authorize"); + expect(String(body.token_endpoint)).toContain("/api/auth/mcp/token"); + expect(String(body.registration_endpoint)).toContain("/api/auth/mcp/register"); +}); + +test("serves OAuth Protected Resource metadata at the origin root", async () => { + const res = await handler(new Request(`${BASE}/.well-known/oauth-protected-resource`)); + expect(res.status).toBe(200); + const body = (await res.json()) as Record; + expect(body.resource).toBeDefined(); + expect(Array.isArray(body.authorization_servers)).toBe(true); +}); + +test("an unauthenticated /mcp request returns 401 with a WWW-Authenticate challenge", async () => { + const res = await handler( + new Request(`${BASE}/mcp`, { + method: "POST", + headers: { + "content-type": "application/json", + accept: "application/json, text/event-stream", + }, + body: JSON.stringify({ jsonrpc: "2.0", id: 1, method: "initialize", params: {} }), + }), + ); + expect(res.status).toBe(401); + const challenge = res.headers.get("www-authenticate") ?? ""; + expect(challenge).toContain("Bearer"); + expect(challenge).toContain("resource_metadata="); +}); + +// --- End-to-end MCP OAuth: DCR -> authorize -> token -> /mcp with bearer --- +const json = async (res: Response) => (await res.json()) as Record; + +const signUp = async (email: string): Promise => { + const res = await handler( + new Request(`${BASE}/api/auth/sign-up/email`, { + method: "POST", + headers: { "content-type": "application/json" }, + body: JSON.stringify({ email, password: "password-12345678", name: email }), + }), + ); + expect(res.status).toBe(200); + // The session cookie lets /mcp/authorize skip the interactive login. + return res.headers.get("set-cookie") ?? ""; +}; + +const b64url = (buf: Uint8Array): string => + btoa(String.fromCharCode(...buf)) + .replaceAll("+", "-") + .replaceAll("/", "_") + .replaceAll("=", ""); + +test("MCP OAuth opaque-bearer flow authenticates /mcp end-to-end", async () => { + const cookie = await signUp("oauth@env.test"); + + // 1. Dynamic client registration (public/PKCE client). + const reg = await handler( + new Request(`${BASE}/api/auth/mcp/register`, { + method: "POST", + headers: { "content-type": "application/json" }, + body: JSON.stringify({ + client_name: "test-client", + redirect_uris: ["http://localhost:9999/callback"], + token_endpoint_auth_method: "none", + grant_types: ["authorization_code"], + response_types: ["code"], + }), + }), + ); + expect([200, 201]).toContain(reg.status); + const clientId = String((await json(reg)).client_id); + + // 2. PKCE authorize with the signed-in session cookie -> 302 to redirect_uri?code=… + const verifier = b64url(crypto.getRandomValues(new Uint8Array(32))); + const challengeBytes = new Uint8Array( + await crypto.subtle.digest("SHA-256", new TextEncoder().encode(verifier)), + ); + const codeChallenge = b64url(challengeBytes); + const authorizeUrl = new URL(`${BASE}/api/auth/mcp/authorize`); + authorizeUrl.search = new URLSearchParams({ + response_type: "code", + client_id: clientId, + redirect_uri: "http://localhost:9999/callback", + code_challenge: codeChallenge, + code_challenge_method: "S256", + scope: "openid", + }).toString(); + const authorize = await handler( + new Request(authorizeUrl, { headers: { cookie }, redirect: "manual" }), + ); + expect([302, 200]).toContain(authorize.status); + const location = authorize.headers.get("location") ?? ""; + const code = new URL(location).searchParams.get("code") ?? ""; + expect(code).not.toBe(""); + + // 3. Token exchange. + const token = await handler( + new Request(`${BASE}/api/auth/mcp/token`, { + method: "POST", + headers: { "content-type": "application/x-www-form-urlencoded" }, + body: new URLSearchParams({ + grant_type: "authorization_code", + code, + redirect_uri: "http://localhost:9999/callback", + client_id: clientId, + code_verifier: verifier, + }).toString(), + }), + ); + expect(token.status).toBe(200); + const accessToken = String((await json(token)).access_token); + expect(accessToken).not.toBe(""); + + // 4. The opaque access token authenticates /mcp (initialize succeeds). + const init = await handler( + new Request(`${BASE}/mcp`, { + method: "POST", + headers: { + authorization: `Bearer ${accessToken}`, + "content-type": "application/json", + accept: "application/json, text/event-stream", + }, + body: JSON.stringify({ + jsonrpc: "2.0", + id: 1, + method: "initialize", + params: { + protocolVersion: "2025-03-26", + capabilities: {}, + clientInfo: { name: "t", version: "1" }, + }, + }), + }), + ); + expect(init.status).toBe(200); + expect(init.headers.get("mcp-session-id")).not.toBe(null); +}); diff --git a/apps/host-selfhost/src/mcp/mcp.test.ts b/apps/host-selfhost/src/mcp/mcp.test.ts new file mode 100644 index 000000000..1c51782f1 --- /dev/null +++ b/apps/host-selfhost/src/mcp/mcp.test.ts @@ -0,0 +1,171 @@ +import { mkdtempSync } from "node:fs"; +import { tmpdir } from "node:os"; +import { join } from "node:path"; + +import { afterAll, expect, test } from "@effect/vitest"; + +process.env.EXECUTOR_DATA_DIR = mkdtempSync(join(tmpdir(), "eh-mcp-")); +process.env.BETTER_AUTH_SECRET = "mcp-test-secret-0123456789-abcdefghij-klmnop"; +process.env.EXECUTOR_BOOTSTRAP_ADMIN_EMAIL = "admin@mcp.test"; +process.env.EXECUTOR_BOOTSTRAP_ADMIN_PASSWORD = "admin-pass-123456"; + +const { makeSelfHostApiHandler } = await import("../app"); + +const { handler, dispose } = await makeSelfHostApiHandler(); +afterAll(() => dispose()); + +const BASE = "http://localhost:4788"; + +const signUp = async (email: string): Promise => { + const res = await handler( + new Request(`${BASE}/api/auth/sign-up/email`, { + method: "POST", + headers: { "content-type": "application/json" }, + body: JSON.stringify({ email, password: "password-12345678", name: email }), + }), + ); + expect(res.status).toBe(200); + return res.headers.get("set-auth-token") ?? ""; +}; + +const mcp = (token: string, body: unknown, sessionId?: string) => + handler( + new Request(`${BASE}/mcp`, { + method: "POST", + headers: { + authorization: `Bearer ${token}`, + "content-type": "application/json", + accept: "application/json, text/event-stream", + ...(sessionId ? { "mcp-session-id": sessionId } : {}), + }, + body: JSON.stringify(body), + }), + ); + +const initSession = async (token: string): Promise => { + const res = await mcp(token, { + jsonrpc: "2.0", + id: 1, + method: "initialize", + params: { + protocolVersion: "2025-03-26", + capabilities: {}, + clientInfo: { name: "t", version: "1" }, + }, + }); + expect(res.status).toBe(200); + const sessionId = res.headers.get("mcp-session-id") ?? ""; + expect(sessionId).not.toBe(""); + await res.text(); + await mcp(token, { jsonrpc: "2.0", method: "notifications/initialized" }, sessionId); + return sessionId; +}; + +test("an authenticated MCP client initializes, lists tools, and executes code", async () => { + const token = await signUp("alice@mcp.test"); + const sessionId = await initSession(token); + + const list = await mcp(token, { jsonrpc: "2.0", id: 2, method: "tools/list" }, sessionId); + const listBody = (await list.json()) as { result: { tools: ReadonlyArray<{ name: string }> } }; + expect(listBody.result.tools.map((tool) => tool.name)).toContain("execute"); + + const call = await mcp( + token, + { + jsonrpc: "2.0", + id: 3, + method: "tools/call", + params: { name: "execute", arguments: { code: "export default 6 * 7" } }, + }, + sessionId, + ); + expect(call.status).toBe(200); + expect(JSON.stringify(await call.json())).toContain("42"); +}); + +test("an MCP session cannot be reused by another user, and unauth is rejected", async () => { + const alice = await signUp("alice2@mcp.test"); + const bob = await signUp("bob2@mcp.test"); + const aliceSession = await initSession(alice); + + // Bob presents Alice's session id with his own token. Cross-bearer access is + // 403 JSON-RPC -32003 — unified with cloud's "does not belong" contract + // (deliberate self-host change from the prior 404). + const reuse = await mcp(bob, { jsonrpc: "2.0", id: 9, method: "tools/list" }, aliceSession); + expect(reuse.status).toBe(403); + const reuseBody = (await reuse.json()) as { + readonly jsonrpc: string; + readonly error?: { readonly code: number; readonly message: string }; + }; + expect(reuseBody.jsonrpc).toBe("2.0"); + expect(reuseBody.error?.code).toBe(-32003); + expect(reuseBody.error?.message).toMatch(/does not belong/i); + + // No credentials at all -> 401. + const noAuth = await handler( + new Request(`${BASE}/mcp`, { + method: "POST", + headers: { + "content-type": "application/json", + accept: "application/json, text/event-stream", + }, + body: JSON.stringify({ + jsonrpc: "2.0", + id: 1, + method: "initialize", + params: { + protocolVersion: "2025-03-26", + capabilities: {}, + clientInfo: { name: "t", version: "1" }, + }, + }), + }), + ); + expect(noAuth.status).toBe(401); +}); + +test("an unknown MCP session id resolves to 404 (-32001), distinct from cross-bearer 403", async () => { + const carol = await signUp("carol@mcp.test"); + // A well-formed but never-created session id -> not-found, not forbidden. + const unknown = await mcp( + carol, + { jsonrpc: "2.0", id: 1, method: "tools/list" }, + crypto.randomUUID(), + ); + expect(unknown.status).toBe(404); + const body = (await unknown.json()) as { + readonly jsonrpc: string; + readonly error?: { readonly code: number; readonly message: string }; + }; + expect(body.jsonrpc).toBe("2.0"); + expect(body.error?.code).toBe(-32001); +}); + +test("GET /mcp without a session id is 400; DELETE without a session id is 204", async () => { + const dave = await signUp("dave@mcp.test"); + + // GET needs an existing session id (streamable-HTTP SSE channel) -> 400. + const get = await handler( + new Request(`${BASE}/mcp`, { + method: "GET", + headers: { authorization: `Bearer ${dave}`, accept: "text/event-stream" }, + }), + ); + expect(get.status).toBe(400); + const getBody = (await get.json()) as { + readonly jsonrpc: string; + readonly error?: { readonly code: number }; + }; + expect(getBody.jsonrpc).toBe("2.0"); + expect(getBody.error?.code).toBe(-32000); + + // DELETE with no session id is a no-op -> 204, empty body, no engine built. + const del = await handler( + new Request(`${BASE}/mcp`, { + method: "DELETE", + headers: { authorization: `Bearer ${dave}` }, + }), + ); + expect(del.status).toBe(204); + expect(await del.text()).toBe(""); +}); diff --git a/apps/host-selfhost/src/mcp/session-store.ts b/apps/host-selfhost/src/mcp/session-store.ts new file mode 100644 index 000000000..d798e2630 --- /dev/null +++ b/apps/host-selfhost/src/mcp/session-store.ts @@ -0,0 +1,229 @@ +import { Data, Effect, Layer } from "effect"; +import type { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js"; +import { WebStandardStreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/webStandardStreamableHttp.js"; + +import { ErrorCapture } from "@executor-js/api"; +import { + jsonRpcErrorBody, + McpErrorReporter, + McpSessionStore, + principalOwns, + type McpDispatchInput, + type McpDispatchResult, + type Principal, +} from "@executor-js/host-mcp"; +import { createExecutorMcpServer } from "@executor-js/host-mcp/tool-server"; + +import { ErrorCaptureLive } from "../observability"; +import { SelfHostDb, type SelfHostDbHandle } from "../db/self-host-db"; +import { makeExecutionStack, SelfHostExecutionStackLayer } from "../execution"; + +// --------------------------------------------------------------------------- +// Self-host McpSessionStore adapter — in-process, no Durable Objects. +// +// In the two-seam envelope the store owns the ENTIRE session lifecycle via +// `dispatch`: create (no session id + POST initialize), forward (session id +// present), and ownership (cross-bearer). Three Maps keyed by mcp-session-id — +// transports, servers, owners — hold the live in-process sessions. Fine for a +// single-node self-host; cloud's DO store is the cross-isolate variant of the +// same seam. The per-user executor is a plain value over the shared DB, so +// closing a session is just closing its transport + server. +// +// The engine is a store implementation detail, not an envelope seam: the store +// builds its per-session `McpServer` via `makeExecutionStack` over the shared +// SelfHostDb (`buildServer` below) + `createExecutorMcpServer`. The two-seam +// envelope has no engine seam — for self-host the store owns engine +// construction; cloud's DO builds its engine inside the DO. +// +// `dispatch` returns the transport `Response` to pass through, or: +// - "not-found" (unknown session id) -> envelope renders 404 -32001 +// - "forbidden" (session owned by another bearer) -> envelope renders 403 -32003 +// --------------------------------------------------------------------------- + +/** Engine construction failed for a principal. The store surfaces it as a 500. */ +export class McpEngineBuildError extends Data.TaggedError("McpEngineBuildError")<{ + readonly cause: unknown; +}> {} + +const ignoreClose = (close: (() => Promise) | undefined): Promise => + close + ? Effect.runPromise(Effect.ignore(Effect.tryPromise({ try: close, catch: () => undefined }))) + : Promise.resolve(); + +const formatBoundaryError = (error: unknown): unknown => + // oxlint-disable-next-line executor/no-instanceof-error, executor/no-unknown-error-message -- boundary: log unknown MCP SDK/runtime failures + error instanceof Error ? (error.stack ?? error.message) : error; + +// The store's error bodies are INNER responses (no CORS): the serving envelope +// re-wraps the store `Response` with CORS before it leaves the origin, so the +// canonical renderer is called with `cors: false` to stay byte-identical to the +// prior hand-rolled copy (`content-type: application/json` only). +const jsonRpcError = (status: number, code: number, message: string): Response => + jsonRpcErrorBody(status, code, message, { cors: false }); + +/** Build the per-session `McpServer` for a principal (engine + factory config). */ +type BuildServer = (principal: Principal) => Effect.Effect; + +interface SelfHostMcpSessionStore { + readonly store: McpSessionStore["Service"]; + readonly close: () => Promise; +} + +/** + * The store's internal engine boundary: build the per-(user,org) scoped + * executor over the long-lived `SelfHostDb` (QuickJS code substrate) and hand + * the engine to `createExecutorMcpServer`. Engine construction reads the + * long-lived DB, so this closes over the handle captured at boot — no + * per-request layer plumbing. NOT an envelope seam; the store owns it. + */ +const makeBuildServer = + (db: SelfHostDbHandle): BuildServer => + (principal) => + makeExecutionStack( + principal.accountId, + principal.organizationId, + principal.organizationName, + ).pipe( + Effect.map(({ engine }) => engine), + Effect.provide(SelfHostExecutionStackLayer), + Effect.provideService(SelfHostDb, db), + Effect.mapError((cause) => new McpEngineBuildError({ cause })), + Effect.flatMap((engine) => createExecutorMcpServer({ engine })), + ); + +/** + * Build the in-process session store plus an explicit `close()` that disposes + * all live sessions (wired into the app's shutdown). `close()` is not part of + * the seam — it is the self-host lifetime hook the envelope doesn't own. The + * store builds its per-session engine over the long-lived `SelfHostDb` handle. + */ +export const makeSelfHostMcpSessionStore = (db: SelfHostDbHandle): SelfHostMcpSessionStore => { + const buildServer = makeBuildServer(db); + const transports = new Map(); + const servers = new Map(); + const owners = new Map(); + + const dispose = async (id: string, opts: { transport?: boolean; server?: boolean } = {}) => { + const transport = transports.get(id); + const server = servers.get(id); + transports.delete(id); + servers.delete(id); + owners.delete(id); + if (opts.transport) await ignoreClose(transport ? () => transport.close() : undefined); + if (opts.server) await ignoreClose(server ? () => server.close() : undefined); + }; + + /** + * Drive a transport for one web request, recovering any defect to a 500. On a + * fresh transport that never minted a session id (e.g. a non-initialize first + * request), close it and its server eagerly so they don't leak. + */ + const runHandleRequest = ( + transport: WebStandardStreamableHTTPServerTransport, + request: Request, + onClose?: () => void, + ): Effect.Effect => { + const finish = (): void => { + if (onClose && !transport.sessionId) onClose(); + }; + return Effect.promise(() => transport.handleRequest(request)).pipe( + Effect.tap(() => Effect.sync(finish)), + Effect.catchCause((cause) => + Effect.sync(() => { + console.error("[mcp] handleRequest error:", formatBoundaryError(cause)); + finish(); + return jsonRpcError(500, -32603, "Internal server error"); + }), + ), + ); + }; + + /** Forward to an existing session, enforcing ownership against the principal. */ + const forward = ( + sessionId: string, + principal: Principal, + request: Request, + ): Effect.Effect => { + const transport = transports.get(sessionId); + const owner = owners.get(sessionId); + if (!transport || !owner) return Effect.succeed("not-found"); + if (!principalOwns(owner, principal)) return Effect.succeed("forbidden"); + return runHandleRequest(transport, request); + }; + + /** Open a new session: build the server, connect a transport, drive the request. */ + const create = (principal: Principal, request: Request): Effect.Effect => + buildServer(principal).pipe( + Effect.flatMap((server) => + Effect.gen(function* () { + const transport = new WebStandardStreamableHTTPServerTransport({ + sessionIdGenerator: () => crypto.randomUUID(), + enableJsonResponse: true, + onsessioninitialized: (sid) => { + transports.set(sid, transport); + servers.set(sid, server); + owners.set(sid, principal); + }, + onsessionclosed: (sid) => void dispose(sid, { server: true }), + }); + transport.onclose = () => { + const sid = transport.sessionId; + if (sid) void dispose(sid, { server: true }); + }; + yield* Effect.promise(() => server.connect(transport)); + // The session id is minted on the first (initialize) request, so we + // drive `handleRequest` here; if no id results we close eagerly. + return yield* runHandleRequest(transport, request, () => { + void ignoreClose(() => transport.close()); + void ignoreClose(() => server.close()); + }); + }), + ), + // A build failure has nowhere typed to go in the envelope; render a 500. + Effect.catchTag("McpEngineBuildError", () => + Effect.succeed(jsonRpcError(500, -32603, "Internal server error")), + ), + ); + + const store: McpSessionStore["Service"] = { + dispatch: ({ request, principal, sessionId }: McpDispatchInput) => + sessionId ? forward(sessionId, principal, request) : create(principal, request), + dispose: (sessionId) => + Effect.promise(() => dispose(sessionId, { transport: true, server: true })), + }; + + return { + store, + close: async () => { + const ids = new Set([...transports.keys(), ...servers.keys()]); + await Promise.all([...ids].map((id) => dispose(id, { transport: true, server: true }))); + }, + }; +}; + +/** + * Layer wrapping a freshly built in-process store, the `McpSessionStore` + * envelope seam. The owning app calls `makeSelfHostMcpSessionStore(db)` directly + * so it can wire the `close()` lifetime hook into shutdown, then passes the + * built store here. + */ +export const selfHostMcpSessions = (built: SelfHostMcpSessionStore): Layer.Layer => + Layer.succeed(McpSessionStore)(built.store); + +// --------------------------------------------------------------------------- +// Self-host McpErrorReporter seam — reuses the shared `ErrorCapture` service so +// a request-orchestration defect the shared MCP envelope is about to render as a +// JSON-RPC 500 still flows through the host's normal capture pipeline (self-host: +// the console `ErrorCaptureLive`). Without this seam override the envelope +// swallows the cause into a `Response` and the operator never sees it. +// --------------------------------------------------------------------------- + +export const selfHostMcpReporter: Layer.Layer = Layer.effect( + McpErrorReporter, + Effect.gen(function* () { + const capture = yield* ErrorCapture; + return { + report: (cause) => Effect.asVoid(capture.captureException(cause)), + }; + }), +).pipe(Layer.provide(ErrorCaptureLive)); diff --git a/apps/host-selfhost/src/multi-user.test.ts b/apps/host-selfhost/src/multi-user.test.ts new file mode 100644 index 000000000..c56ca875e --- /dev/null +++ b/apps/host-selfhost/src/multi-user.test.ts @@ -0,0 +1,104 @@ +import { mkdtempSync } from "node:fs"; +import { tmpdir } from "node:os"; +import { join } from "node:path"; + +import { afterAll, expect, test } from "@effect/vitest"; + +// Real Better Auth path with multiple accounts. +process.env.EXECUTOR_DATA_DIR = mkdtempSync(join(tmpdir(), "eh-multi-")); +process.env.BETTER_AUTH_SECRET = "multi-user-secret-0123456789-abcdefghij-klmn"; +process.env.EXECUTOR_BOOTSTRAP_ADMIN_EMAIL = "admin@multi.test"; +process.env.EXECUTOR_BOOTSTRAP_ADMIN_PASSWORD = "admin-pass-123456"; + +const { makeSelfHostApiHandler } = await import("./app"); + +const { handler, dispose } = await makeSelfHostApiHandler(); +afterAll(() => dispose()); + +const BASE = "http://localhost:4788"; + +const signUp = async (email: string): Promise => { + const res = await handler( + new Request(`${BASE}/api/auth/sign-up/email`, { + method: "POST", + headers: { "content-type": "application/json" }, + body: JSON.stringify({ email, password: "password-12345678", name: email }), + }), + ); + expect(res.status).toBe(200); + const token = res.headers.get("set-auth-token") ?? ""; + expect(token).not.toBe(""); + return token; +}; + +const scopeOf = async (token: string): Promise<{ userScope: string; orgScope: string }> => { + const res = await handler( + new Request(`${BASE}/api/scope`, { headers: { authorization: `Bearer ${token}` } }), + ); + expect(res.status).toBe(200); + const body = (await res.json()) as { stack: ReadonlyArray<{ id: string }> }; + return { userScope: body.stack[0]!.id, orgScope: body.stack[1]!.id }; +}; + +const setSecret = (token: string, scopeId: string, id: string, value: string) => + handler( + new Request(`${BASE}/api/scopes/${scopeId}/secrets`, { + method: "POST", + headers: { authorization: `Bearer ${token}`, "content-type": "application/json" }, + body: JSON.stringify({ id, name: id, value }), + }), + ); + +const secretResolves = async (token: string, scopeId: string, id: string): Promise => { + const res = await handler( + new Request(`${BASE}/api/scopes/${scopeId}/secrets/${id}/status`, { + headers: { authorization: `Bearer ${token}` }, + }), + ); + if (res.status !== 200) return false; + const body = (await res.json()) as { status: string }; + return body.status === "resolved"; +}; + +const runCode = async (token: string, code: string) => { + const res = await handler( + new Request(`${BASE}/api/executions`, { + method: "POST", + headers: { authorization: `Bearer ${token}`, "content-type": "application/json" }, + body: JSON.stringify({ code }), + }), + ); + return res; +}; + +test("multiple accounts share one org but isolate per-user secrets", async () => { + const alice = await signUp("alice@multi.test"); + const bob = await signUp("bob@multi.test"); + + const a = await scopeOf(alice); + const b = await scopeOf(bob); + + // Same single org, distinct personal (user-org) scopes. + expect(a.orgScope).toBe(b.orgScope); + expect(a.userScope).not.toBe(b.userScope); + + // Alice stores a personal secret on her user-org scope. + expect((await setSecret(alice, a.userScope, "gh", "alice-token")).status).toBe(200); + + // Alice can resolve her own personal secret; Bob cannot see it. + expect(await secretResolves(alice, a.userScope, "gh")).toBe(true); + expect(await secretResolves(bob, a.userScope, "gh")).toBe(false); + + // Org-scoped secrets ARE shared across members of the one org. + expect((await setSecret(alice, a.orgScope, "org-key", "shared-value")).status).toBe(200); + expect(await secretResolves(bob, a.orgScope, "org-key")).toBe(true); +}); + +test("each account can execute code in its own scoped sandbox", async () => { + const carol = await signUp("carol@multi.test"); + const res = await runCode(carol, "export default 21 * 2"); + expect(res.status).toBe(200); + const body = (await res.json()) as { status: string; text: string }; + expect(body.status).toBe("completed"); + expect(body.text).toBe("42"); +}); diff --git a/apps/host-selfhost/src/observability.ts b/apps/host-selfhost/src/observability.ts new file mode 100644 index 000000000..065cf8ddb --- /dev/null +++ b/apps/host-selfhost/src/observability.ts @@ -0,0 +1,11 @@ +// --------------------------------------------------------------------------- +// Self-host `ErrorCapture` — the shared console implementation with a +// `selfhost-` trace id prefix. Prints the squashed + pretty cause to stderr +// and returns a short correlation id that surfaces in the opaque 500 traceId, +// so operators can grep their logs. Cloud swaps in a Sentry-backed impl behind +// the same tag. +// --------------------------------------------------------------------------- + +import { consoleErrorCapture } from "@executor-js/api/server"; + +export const ErrorCaptureLive = consoleErrorCapture("selfhost"); diff --git a/apps/host-selfhost/src/plugins.ts b/apps/host-selfhost/src/plugins.ts new file mode 100644 index 000000000..bbd4c65ef --- /dev/null +++ b/apps/host-selfhost/src/plugins.ts @@ -0,0 +1,12 @@ +// Single shared instantiation of the self-host plugin list, mirroring +// `apps/cloud/src/api/cloud-plugins.ts`. The API composition +// (`composePluginApi`/`composePluginHandlerLayer`) and the per-request +// middleware (`providePluginExtensions`, `PluginExtensionServices<...>`) all +// derive their typed views from this one tuple, so adding/removing a plugin is +// a single `executor.config.ts` edit. The per-request executor builds its own +// fresh `executor.config.ts#plugins()` instances via the `PluginsProvider` seam +// (execution.ts). +import executorConfig from "../executor.config"; + +export const selfHostPlugins = executorConfig.plugins(); +export type SelfHostPlugins = typeof selfHostPlugins; diff --git a/apps/host-selfhost/src/scope-isolation.test.ts b/apps/host-selfhost/src/scope-isolation.test.ts new file mode 100644 index 000000000..317a6cfd4 --- /dev/null +++ b/apps/host-selfhost/src/scope-isolation.test.ts @@ -0,0 +1,55 @@ +import { mkdtempSync } from "node:fs"; +import { tmpdir } from "node:os"; +import { join } from "node:path"; + +import { afterAll, expect, test } from "@effect/vitest"; + +process.env.EXECUTOR_DATA_DIR = mkdtempSync(join(tmpdir(), "eh-iso-")); + +// Identity comes from request headers so a single handler can serve many +// distinct identities concurrently — the setup that would expose a +// cross-fiber scope leak if the executor's scope were shared rather than +// request-scoped. +const { makeSelfHostTestApp, headerIdentityLayer } = await import("./testing/test-app"); + +const { handler, dispose } = await makeSelfHostTestApp({ identity: headerIdentityLayer }); +afterAll(() => dispose()); + +const getScope = async (userId: string, organizationId: string) => { + const res = await handler( + new Request("http://localhost/api/scope", { + headers: { "x-test-user": userId, "x-test-org": organizationId }, + }), + ); + expect(res.status).toBe(200); + return (await res.json()) as { id: string; stack: ReadonlyArray<{ id: string }> }; +}; + +test("concurrent requests with distinct identities get disjoint, correct scope stacks", async () => { + // 6 identities × 8 interleaved requests each = 48 concurrent requests over + // the one long-lived SQLite handle. + const identities = Array.from({ length: 6 }, (_, i) => ({ + userId: `user-${i}`, + organizationId: `org-${i}`, + })); + const requests = Array.from({ length: 48 }, (_, i) => identities[i % identities.length]); + + const results = await Promise.all(requests.map((id) => getScope(id.userId, id.organizationId))); + + results.forEach((scope, i) => { + const { userId, organizationId } = requests[i]; + // Each response reflects ONLY its own request's identity — no bleed. + expect(scope.id).toBe(organizationId); + expect(scope.stack.map((s) => s.id)).toEqual([ + `user-org:${userId}:${organizationId}`, + organizationId, + ]); + }); +}); + +test("a request with no identity is rejected", async () => { + const res = await handler(new Request("http://localhost/api/scope")); + // singleAdmin never returns null, but the header provider does -> the + // middleware's unauthenticated path fires. + expect(res.status).toBeGreaterThanOrEqual(400); +}); diff --git a/apps/host-selfhost/src/secrets-integration.test.ts b/apps/host-selfhost/src/secrets-integration.test.ts new file mode 100644 index 000000000..3bf9cdb01 --- /dev/null +++ b/apps/host-selfhost/src/secrets-integration.test.ts @@ -0,0 +1,75 @@ +import { createClient } from "@libsql/client"; +import { mkdtempSync } from "node:fs"; +import { tmpdir } from "node:os"; +import { join } from "node:path"; + +import { afterAll, expect, test } from "@effect/vitest"; + +const dataDir = mkdtempSync(join(tmpdir(), "eh-secrets-")); +process.env.EXECUTOR_DATA_DIR = dataDir; +process.env.EXECUTOR_SECRET_KEY = "integration-test-master-key"; + +const { makeSelfHostTestApp, singleAdminIdentityLayer } = await import("./testing/test-app"); + +const { handler, dispose } = await makeSelfHostTestApp({ + identity: singleAdminIdentityLayer({ + userId: "admin", + organizationId: "default-org", + organizationName: "Default", + }), +}); +afterAll(() => dispose()); + +const NEEDLE = "PLAINTEXT_NEEDLE_9f3a"; + +test("a secret set via the API is stored encrypted at rest by the 'encrypted' provider", async () => { + const setRes = await handler( + new Request("http://localhost/api/scopes/default-org/secrets", { + method: "POST", + headers: { "content-type": "application/json" }, + body: JSON.stringify({ id: "gh-token", name: "GitHub", value: NEEDLE }), + }), + ); + expect(setRes.status).toBe(200); + const ref = (await setRes.json()) as { id: string; provider: string }; + expect(ref.id).toBe("gh-token"); + // The first writable provider is the encrypted one — it handled the write. + expect(ref.provider).toBe("encrypted"); + + // The status endpoint resolves it (decrypt round-trips through the provider). + const statusRes = await handler( + new Request("http://localhost/api/scopes/default-org/secrets/gh-token/status"), + ); + expect(statusRes.status).toBe(200); + expect(((await statusRes.json()) as { status: string }).status).toBe("resolved"); + + // Inspect the real SQLite file through a SEPARATE libSQL connection (the app's + // own libSQL client wrote it): the plaintext must NOT appear anywhere, and a + // versioned AES-GCM payload ("v1.") must be present. Reading this file through + // an independent connection also exercises the cross-connection visibility of + // FumaDB's writes. + const db = createClient({ url: `file:${join(dataDir, "data.db")}` }); + const tables = (await db.execute("SELECT name FROM sqlite_master WHERE type='table'")).rows.map( + // oxlint-disable-next-line executor/no-redundant-primitive-cast -- boundary: sqlite_master.name is TEXT; narrow libSQL's SQLValue to string for the table list + (r) => r.name as string, + ); + const cells: string[] = []; + for (const name of tables) { + const rows = (await db.execute(`SELECT * FROM "${name}"`)).rows; + for (const row of rows) { + for (const value of Object.values(row)) { + // Plugin-storage data is a BLOB (libSQL returns ArrayBuffer); decode it. + if (typeof value === "string") cells.push(value); + else if (value instanceof ArrayBuffer) cells.push(Buffer.from(value).toString("utf8")); + else if (ArrayBuffer.isView(value)) + cells.push( + Buffer.from(value.buffer, value.byteOffset, value.byteLength).toString("utf8"), + ); + } + } + } + db.close(); + + expect(cells.some((c) => c.includes(NEEDLE))).toBe(false); + expect(cells.some((c) => c.includes("v1."))).toBe(true); +}); diff --git a/apps/host-selfhost/src/serve.ts b/apps/host-selfhost/src/serve.ts new file mode 100644 index 000000000..c48db6b01 --- /dev/null +++ b/apps/host-selfhost/src/serve.ts @@ -0,0 +1,49 @@ +/** + * Self-hosted Executor server. + * + * The entire HTTP app is ONE Effect `AppLayer`; the platform is just a provided + * layer. Self-host binds it to a listening Bun socket via `BunHttpServer.layer`. + * All routing lives in the Effect router — no hand-written fetch: + * - /api/* typed API (auth-gated) + * - /api/auth/* Better Auth + * - /mcp MCP (per-user) + * - /docs Swagger + * - everything else: the built web SPA (static files + index.html fallback) + * + * Run directly: bun run apps/host-selfhost/src/serve.ts (after `bun run build`) + */ + +import { fileURLToPath } from "node:url"; + +import { HttpRouter, HttpStaticServer } from "effect/unstable/http"; +import { BunFileSystem, BunHttpServer, BunPath, BunRuntime } from "@effect/platform-bun"; +import { Layer } from "effect"; + +import { makeSelfHostApp } from "./app"; +import { loadConfig } from "./config"; + +const distDir = fileURLToPath(new URL("../dist/", import.meta.url)); + +export const startServer = async (): Promise => { + const config = loadConfig(); + const { AppLayer } = await makeSelfHostApp(); + + // Serve the built SPA. Specific API/docs/auth/mcp routes take precedence; + // `spa: true` falls back to index.html for any other path (client routing). + const StaticLive = HttpStaticServer.layer({ root: distDir, spa: true }).pipe( + Layer.provide(BunFileSystem.layer), + Layer.provide(BunPath.layer), + ); + + const ServerLive = HttpRouter.serve(Layer.mergeAll(AppLayer, StaticLive)).pipe( + Layer.provide( + BunHttpServer.layer({ hostname: config.host, port: config.port, idleTimeout: 0 }), + ), + ); + + await BunRuntime.runMain(Layer.launch(ServerLive)); +}; + +if (import.meta.main) { + await startServer(); +} diff --git a/apps/host-selfhost/src/sources-mcp.test.ts b/apps/host-selfhost/src/sources-mcp.test.ts new file mode 100644 index 000000000..50b50d175 --- /dev/null +++ b/apps/host-selfhost/src/sources-mcp.test.ts @@ -0,0 +1,144 @@ +import { mkdtempSync } from "node:fs"; +import { tmpdir } from "node:os"; +import { join } from "node:path"; + +import { Effect, Layer } from "effect"; +import { afterAll, expect, test } from "@effect/vitest"; + +import { makeScopedExecutor } from "@executor-js/api/server"; + +import { createSelfHostDb, SelfHostDb } from "./db/self-host-db"; +import { SelfHostScopedExecutorSeams } from "./execution"; +import type { SelfHostPlugins } from "./plugins"; + +// The self-host scoped-executor seams (DbProvider over the long-lived SelfHostDb, +// fresh per-request plugins, host config) over the shared `makeScopedExecutor`, +// leaving `SelfHostDb` as the only requirement (the production path provides the +// same seams via `SelfHostExecutionStackLayer`). +const createScopedExecutor = ( + accountId: string, + organizationId: string, + organizationName: string, +) => + makeScopedExecutor(accountId, organizationId, organizationName).pipe( + Effect.provide(SelfHostScopedExecutorSeams), + ); + +// End-to-end: an org source is reachable from a user's MCP `execute` sandbox. +const dataDir = mkdtempSync(join(tmpdir(), "eh-srcmcp-")); +const dbPath = join(dataDir, "data.db"); +process.env.EXECUTOR_DATA_DIR = dataDir; +process.env.BETTER_AUTH_SECRET = "srcmcp-secret-0123456789-abcdefghij-klmnop"; +process.env.EXECUTOR_BOOTSTRAP_ADMIN_EMAIL = "admin@srcmcp.test"; +process.env.EXECUTOR_BOOTSTRAP_ADMIN_PASSWORD = "admin-pass-123456"; + +const TINY_SPEC = JSON.stringify({ + openapi: "3.0.0", + info: { title: "Tiny", version: "1.0.0" }, + servers: [{ url: "https://httpbin.org" }], + paths: { + "/get": { + get: { + operationId: "httpGet", + summary: "Tiny get operation", + responses: { "200": { description: "ok" } }, + }, + }, + }, +}); + +const { makeSelfHostApiHandler } = await import("./app"); +const { handler, dispose } = await makeSelfHostApiHandler({ dbPath }); +afterAll(() => dispose()); + +const BASE = "http://localhost:4788"; + +const addOrgSource = async (organizationId: string): Promise => { + // Install the source at the (Better Auth) org scope, on its own connection to + // the shared DB file. WAL makes the committed rows visible to the server. + const seedDb = await createSelfHostDb({ + path: dbPath, + namespace: "executor_selfhost", + version: "1.0.0", + }); + await Effect.runPromise( + Effect.gen(function* () { + const admin = yield* createScopedExecutor("seed", organizationId, "Default"); + yield* admin.openapi.addSpec({ + spec: { kind: "blob", value: TINY_SPEC }, + scope: organizationId, + name: "tiny", + namespace: "tiny", + baseUrl: "", + }); + }).pipe(Effect.provide(Layer.succeed(SelfHostDb)(seedDb)), Effect.scoped), + ); + await seedDb.close(); +}; + +test("a user's MCP execute sandbox can reach an org source's tools", async () => { + const su = await handler( + new Request(`${BASE}/api/auth/sign-up/email`, { + method: "POST", + headers: { "content-type": "application/json" }, + body: JSON.stringify({ email: "u@srcmcp.test", password: "password-12345678", name: "U" }), + }), + ); + const token = su.headers.get("set-auth-token") ?? ""; + expect(token).not.toBe(""); + + // The user's real org scope (Better Auth assigns a random org id). + const scopeRes = await handler( + new Request(`${BASE}/api/scope`, { headers: { authorization: `Bearer ${token}` } }), + ); + const organizationId = ((await scopeRes.json()) as { stack: ReadonlyArray<{ id: string }> }) + .stack[1]!.id; + + await addOrgSource(organizationId); + + const mcp = (body: unknown, sessionId?: string) => + handler( + new Request(`${BASE}/mcp`, { + method: "POST", + headers: { + authorization: `Bearer ${token}`, + "content-type": "application/json", + accept: "application/json, text/event-stream", + ...(sessionId ? { "mcp-session-id": sessionId } : {}), + }, + body: JSON.stringify(body), + }), + ); + + const init = await mcp({ + jsonrpc: "2.0", + id: 1, + method: "initialize", + params: { + protocolVersion: "2025-03-26", + capabilities: {}, + clientInfo: { name: "t", version: "1" }, + }, + }); + const sessionId = init.headers.get("mcp-session-id") ?? ""; + expect(sessionId).not.toBe(""); + await init.text(); + await mcp({ jsonrpc: "2.0", method: "notifications/initialized" }, sessionId); + + const call = await mcp( + { + jsonrpc: "2.0", + id: 3, + method: "tools/call", + params: { + name: "execute", + arguments: { + code: 'export default (await tools.search({ query: "tiny get operation", limit: 10 })).items.map((m) => m.path)', + }, + }, + }, + sessionId, + ); + expect(call.status).toBe(200); + expect(JSON.stringify(await call.json())).toContain("tiny"); +}); diff --git a/apps/host-selfhost/src/sources.test.ts b/apps/host-selfhost/src/sources.test.ts new file mode 100644 index 000000000..6eebe845b --- /dev/null +++ b/apps/host-selfhost/src/sources.test.ts @@ -0,0 +1,76 @@ +import { mkdtempSync } from "node:fs"; +import { tmpdir } from "node:os"; +import { join } from "node:path"; + +import { Effect, Layer } from "effect"; +import { afterAll, expect, test } from "@effect/vitest"; + +import { makeScopedExecutor } from "@executor-js/api/server"; + +import { createSelfHostDb, SelfHostDb } from "./db/self-host-db"; +import { SelfHostScopedExecutorSeams } from "./execution"; +import type { SelfHostPlugins } from "./plugins"; + +// The self-host scoped-executor seams (DbProvider over the long-lived SelfHostDb, +// fresh per-request plugins, host config) over the shared `makeScopedExecutor`, +// leaving `SelfHostDb` as the only requirement (the production path provides the +// same seams via `SelfHostExecutionStackLayer`). +const createScopedExecutor = ( + accountId: string, + organizationId: string, + organizationName: string, +) => + makeScopedExecutor(accountId, organizationId, organizationName).pipe( + Effect.provide(SelfHostScopedExecutorSeams), + ); + +const dataDir = mkdtempSync(join(tmpdir(), "eh-src-")); +process.env.EXECUTOR_DATA_DIR = dataDir; + +const dbHandle = await createSelfHostDb({ + path: join(dataDir, "data.db"), + namespace: "executor_selfhost", + version: "1.0.0", +}); +const dbLayer = Layer.succeed(SelfHostDb)(dbHandle); +afterAll(() => dbHandle.close()); + +// Inline OpenAPI spec so the test doesn't depend on the network to register. +const TINY_SPEC = JSON.stringify({ + openapi: "3.0.0", + info: { title: "Tiny", version: "1.0.0" }, + servers: [{ url: "https://httpbin.org" }], + paths: { + "/get": { + get: { operationId: "httpGet", summary: "GET", responses: { "200": { description: "ok" } } }, + }, + }, +}); + +test("an org-scoped OpenAPI source registers tools shared across org members", async () => { + // Alice (a member) adds a source at the org install scope. + const added = await Effect.runPromise( + Effect.gen(function* () { + const alice = yield* createScopedExecutor("alice", "default-org", "Default"); + return yield* alice.openapi.addSpec({ + spec: { kind: "blob", value: TINY_SPEC }, + scope: "default-org", + name: "tiny", + namespace: "tiny", + baseUrl: "", + }); + }).pipe(Effect.provide(dbLayer), Effect.scoped), + ); + expect(added.sourceId).toBe("tiny"); + expect(added.toolCount).toBeGreaterThan(0); + + // Bob — a different user in the SAME org — sees the org-scoped source's tools. + const bobToolIds = await Effect.runPromise( + Effect.gen(function* () { + const bob = yield* createScopedExecutor("bob", "default-org", "Default"); + const tools = yield* bob.tools.list(); + return tools.map((tool) => String(tool.id)); + }).pipe(Effect.provide(dbLayer), Effect.scoped), + ); + expect(bobToolIds.some((id) => id.startsWith("tiny."))).toBe(true); +}); diff --git a/apps/host-selfhost/src/testing/test-app.ts b/apps/host-selfhost/src/testing/test-app.ts new file mode 100644 index 000000000..9dc707d90 --- /dev/null +++ b/apps/host-selfhost/src/testing/test-app.ts @@ -0,0 +1,224 @@ +import { HttpApiSwagger } from "effect/unstable/httpapi"; +import { Effect, Layer } from "effect"; + +import { + composePluginApi, + ExecutorApp, + IdentityProvider, + type Principal, + textFailureStrategy, + Unauthorized, +} from "@executor-js/api/server"; +import { + authenticated, + McpAuthProvider, + unauthorized, + type AuthOutcome, +} from "@executor-js/host-mcp"; + +import { createSelfHostDb, SelfHostDb, SelfHostDbProvider } from "../db/self-host-db"; +import { + SelfHostCodeExecutorProvider, + SelfHostHostConfig, + SelfHostPluginsProvider, +} from "../execution"; +import { loadConfig, SELF_HOST_NAMESPACE, SELF_HOST_SCHEMA_VERSION } from "../config"; +import { + makeSelfHostMcpSessionStore, + selfHostMcpReporter, + selfHostMcpSessions, +} from "../mcp/session-store"; +import { selfHostPlugins } from "../plugins"; +import { ErrorCaptureLive } from "../observability"; + +// =========================================================================== +// Self-host TEST harness — the throwaway composition tests use to exercise the +// shared app graph WITHOUT booting Better Auth. +// +// Production (`makeSelfHostApp`) is unconditional: it always builds Better Auth +// over the libSQL file, mounts the account API, and serves the real MCP OAuth +// seam. Tests that don't need a real auth backend (scope-stack isolation, the +// QuickJS sandbox, encrypted-secret-at-rest) want a trivial, deterministic +// identity and no auth secret. That test-only wiring used to live in production +// behind `if (injectedIdentity)` branches; it now lives HERE. +// +// `makeSelfHostTestApp` composes `ExecutorApp.make` directly with: +// - a test `IdentityProvider` (single-admin or header-driven), +// - a stub `McpAuthProvider` (no OAuth Authorization Server; authenticate via +// the same injected identity), +// - NO account API (Better Auth is never constructed), +// - a throwaway libSQL path. +// +// Tests that DO need the real Better Auth backend (multi-user sign-up, the MCP +// OAuth DCR -> authorize -> token flow) use the production `makeSelfHostApiHandler` +// instead — that path is the honest unconditional composition. +// =========================================================================== + +// --------------------------------------------------------------------------- +// Test identities — trivial `IdentityProvider` implementations of the shared +// tag. The single-admin one resolves every request to one configured admin; the +// header-driven one reads the identity from request headers so a single handler +// can serve many distinct identities concurrently (cross-fiber scope-leak test). +// --------------------------------------------------------------------------- + +export interface SingleAdminOptions { + readonly userId: string; + readonly organizationId: string; + readonly organizationName: string; + readonly email?: string; +} + +/** Every request is the configured single admin. */ +export const singleAdminIdentityLayer = ( + options: SingleAdminOptions, +): Layer.Layer => + Layer.succeed( + IdentityProvider, + IdentityProvider.of({ + authenticate: () => + Effect.succeed({ + accountId: options.userId, + organizationId: options.organizationId, + organizationName: options.organizationName, + email: options.email ?? "admin@localhost", + name: "Admin", + avatarUrl: null, + roles: ["admin"], + }), + }), + ); + +/** + * Resolve the identity from `x-test-user` / `x-test-org` headers (missing either + * -> `Unauthorized`). Lets one handler serve many identities concurrently. + */ +export const headerIdentityLayer: Layer.Layer = Layer.succeed( + IdentityProvider, + IdentityProvider.of({ + authenticate: (request) => { + const userId = request.headers.get("x-test-user"); + const organizationId = request.headers.get("x-test-org"); + if (!userId || !organizationId) return Effect.fail(new Unauthorized()); + return Effect.succeed({ + accountId: userId, + organizationId, + organizationName: `Org ${organizationId}`, + email: `${userId}@test`, + name: userId, + avatarUrl: null, + roles: ["admin"], + }); + }, + }), +); + +// --------------------------------------------------------------------------- +// Stub McpAuthProvider — no OAuth Authorization Server, so the declared metadata +// docs 404; authentication delegates to the injected test `IdentityProvider`. +// Keeps /mcp mountable under the test composition without Better Auth. +// --------------------------------------------------------------------------- + +const PROTECTED_RESOURCE_METADATA_PATH = "/.well-known/oauth-protected-resource"; +const AUTHORIZATION_SERVER_METADATA_PATH = "/.well-known/oauth-authorization-server"; + +const resourceMetadataUrlFor = (request: Request): string => + `${new URL(request.url).origin}${PROTECTED_RESOURCE_METADATA_PATH}`; + +const notFoundResponse = (): Effect.Effect => + Effect.sync(() => new Response("Not Found", { status: 404 })); + +const stubMcpAuth: Layer.Layer = Layer.effect( + McpAuthProvider, + Effect.gen(function* () { + const fallback = yield* IdentityProvider; + const challengeFor = (request: Request): string => + `Bearer resource_metadata="${resourceMetadataUrlFor(request)}"`; + return { + discoveryRoutes: [ + { path: PROTECTED_RESOURCE_METADATA_PATH, handler: notFoundResponse }, + { path: AUTHORIZATION_SERVER_METADATA_PATH, handler: notFoundResponse }, + ], + resourceMetadataUrl: resourceMetadataUrlFor, + authenticate: (request: Request): Effect.Effect => + fallback.authenticate(request).pipe( + Effect.map((principal) => + principal ? authenticated(principal) : unauthorized(challengeFor(request)), + ), + Effect.catchTags({ + Unauthorized: () => Effect.succeed(unauthorized(challengeFor(request))), + NoOrganization: () => Effect.succeed(unauthorized(challengeFor(request))), + }), + ), + }; + }), +); + +// --------------------------------------------------------------------------- +// makeSelfHostTestApp — the same `ExecutorApp.make` composition the production +// app uses, but with the test identity + stub MCP auth + no account, over a +// throwaway libSQL file. Returns the same `{ handler, dispose }` shape the +// production `makeSelfHostApiHandler` returns. +// --------------------------------------------------------------------------- + +export interface MakeSelfHostTestAppOptions { + /** The test `IdentityProvider` (single-admin / header-driven). */ + readonly identity: Layer.Layer; + /** Override the SQLite path (defaults to the config data dir). */ + readonly dbPath?: string; +} + +export interface SelfHostTestHandler { + /** Unified web handler: serves /api/*, /mcp, and /docs (no /api/auth). */ + readonly handler: (request: Request) => Promise; + readonly dispose: () => Promise; +} + +export const makeSelfHostTestApp = async ( + options: MakeSelfHostTestAppOptions, +): Promise => { + const config = loadConfig(); + + const dbHandle = await createSelfHostDb({ + path: options.dbPath ?? config.dbPath, + namespace: SELF_HOST_NAMESPACE, + version: SELF_HOST_SCHEMA_VERSION, + }); + + const sessionStore = makeSelfHostMcpSessionStore(dbHandle); + + const { toWebHandler } = ExecutorApp.make({ + plugins: selfHostPlugins, + providers: { + identity: options.identity, + db: SelfHostDbProvider, + engine: { codeExecutor: SelfHostCodeExecutorProvider }, + mcp: { + auth: stubMcpAuth, + sessions: selfHostMcpSessions(sessionStore), + reporter: selfHostMcpReporter, + }, + plugins: { provider: SelfHostPluginsProvider, config: SelfHostHostConfig }, + errorCapture: ErrorCaptureLive, + }, + extensions: { + routes: [ + HttpApiSwagger.layer(composePluginApi(selfHostPlugins).prefix("/api"), { path: "/docs" }), + ], + }, + config: { mountPrefix: "/api", failure: textFailureStrategy }, + // The test identity is boot-scoped exactly as production's is: no + // requestScoped layer, so the execution middleware leaves IdentityProvider + // residual and `provideMerge(boot)` supplies it. + boot: Layer.merge(Layer.succeed(SelfHostDb)(dbHandle), options.identity), + }); + + const web = toWebHandler(); + return { + handler: web.handler, + dispose: async () => { + await web.dispose(); + await sessionStore.close(); + await dbHandle.close(); + }, + }; +}; diff --git a/apps/host-selfhost/tsconfig.json b/apps/host-selfhost/tsconfig.json new file mode 100644 index 000000000..e214693ed --- /dev/null +++ b/apps/host-selfhost/tsconfig.json @@ -0,0 +1,24 @@ +{ + "compilerOptions": { + "target": "ESNext", + "module": "ESNext", + "moduleResolution": "bundler", + "strict": true, + "esModuleInterop": true, + "skipLibCheck": true, + "types": ["bun-types"], + "noUnusedLocals": true, + "noImplicitOverride": true, + "plugins": [ + { + "name": "@effect/language-service", + "ignoreEffectSuggestionsInTscExitCode": true, + "ignoreEffectWarningsInTscExitCode": true, + "diagnosticSeverity": { + "preferSchemaOverJson": "off" + } + } + ] + }, + "include": ["src/**/*.ts", "executor.config.ts"] +} diff --git a/apps/host-selfhost/vite.config.ts b/apps/host-selfhost/vite.config.ts new file mode 100644 index 000000000..2b1aab913 --- /dev/null +++ b/apps/host-selfhost/vite.config.ts @@ -0,0 +1,136 @@ +import { Readable } from "node:stream"; +import { fileURLToPath } from "node:url"; + +import { defineConfig, type Plugin } from "vite"; +import react from "@vitejs/plugin-react"; +import tailwindcss from "@tailwindcss/vite"; +import { tanstackRouter } from "@tanstack/router-plugin/vite"; +import executorVitePlugin from "@executor-js/vite-plugin"; + +// Self-host web SPA. Mirrors @executor-js/app's vite plugin bundle, but points +// the TanStack router codegen at THIS app's routes (web/routes) so we get the +// multiplayer shell + Better-Auth gate (routes/__root.tsx) instead of the +// personal-mode local shell. executorVitePlugin feeds plugin client bundles +// from our executor.config.ts into `virtual:executor/plugins-client`. +const APP_ROOT = fileURLToPath(new URL("../../packages/app/", import.meta.url)); +const DEV_PORT = 5173; + +// Dev defaults so `bun run dev` boots the full stack with zero manual env. +// Set at module load (before any plugin/executor.config reads them). Override +// via real env for anything you care about (esp. BETTER_AUTH_SECRET in prod). +process.env.EXECUTOR_DATA_DIR ??= fileURLToPath(new URL("./.executor-dev/", import.meta.url)); +process.env.BETTER_AUTH_SECRET ??= "executor-selfhost-dev-secret-change-me-0123456789"; +process.env.EXECUTOR_BOOTSTRAP_ADMIN_EMAIL ??= "admin@example.com"; +process.env.EXECUTOR_BOOTSTRAP_ADMIN_PASSWORD ??= "executor-dev-admin"; +process.env.EXECUTOR_WEB_BASE_URL ??= `http://localhost:${DEV_PORT}`; + +// Dev-only: forward /api, /mcp, /docs to the self-host Effect handler in-process +// (the same web handler serve.ts binds). Requires vite to run under Bun +// (`bunx --bun vite dev`) because the handler opens a bun:sqlite DB. No path +// stripping — the self-host API is served under /api by the prefixed router, so +// the handler expects the full path. Handler rebuilds when src/ changes. +function executorApiPlugin(): Plugin { + let handlerPromise: Promise<{ handler: (request: Request) => Promise }> | null = null; + const getHandler = async () => { + if (!handlerPromise) { + // Computed specifier so Vite's Node-based config loader does NOT statically + // follow this into ./src/api/api (which imports @executor-js/host-mcp, whose + // extensionless re-exports resolve under Bun but not Node ESM). It only runs + // at dev-server request time, under `bunx --bun vite dev`. + const apiModule = new URL("./src/api/api.ts", import.meta.url).href; + handlerPromise = import(apiModule).then((m) => m.makeSelfHostApiHandler()); + } + return handlerPromise; + }; + + return { + name: "executor-selfhost-api", + apply: "serve", + configureServer(server) { + server.watcher.on("change", (path) => { + if (path.includes("/src/") || path.endsWith("/executor.config.ts")) handlerPromise = null; + }); + server.middlewares.use(async (req, res, next) => { + const rawUrl = req.url ?? "/"; + const handled = + rawUrl === "/api" || + rawUrl.startsWith("/api/") || + rawUrl.startsWith("/mcp") || + rawUrl.startsWith("/docs"); + if (!handled) return next(); + + // oxlint-disable-next-line executor/no-try-catch-or-throw -- boundary: Vite dev middleware must convert handler failures into HTTP 500 responses + try { + const { handler } = await getHandler(); + const origin = `http://${req.headers.host ?? `localhost:${DEV_PORT}`}`; + const headers = new Headers(); + for (const [key, value] of Object.entries(req.headers)) { + if (value) headers.set(key, Array.isArray(value) ? value.join(", ") : value); + } + const hasBody = req.method !== "GET" && req.method !== "HEAD"; + const webRequest = new Request(new URL(rawUrl, origin), { + method: req.method, + headers, + body: hasBody ? Readable.toWeb(req) : undefined, + duplex: hasBody ? "half" : undefined, + } as RequestInit); + + const response = await handler(webRequest); + res.statusCode = response.status; + response.headers.forEach((value, key) => res.setHeader(key, value)); + if (response.body) { + const reader = response.body.getReader(); + for (;;) { + const { done, value } = await reader.read(); + if (done) break; + res.write(value); + } + } + res.end(); + } catch (err) { + console.error("[executor-selfhost-api]", err); + if (!res.headersSent) { + res.statusCode = 500; + res.end("Internal Server Error"); + } + } + }); + }, + }; +} + +export default defineConfig({ + root: fileURLToPath(new URL("./web/", import.meta.url)), + publicDir: fileURLToPath(new URL("../../packages/app/public/", import.meta.url)), + build: { + outDir: fileURLToPath(new URL("./dist/", import.meta.url)), + emptyOutDir: true, + }, + resolve: { + alias: { "@executor-app": APP_ROOT }, + dedupe: ["react", "react-dom"], + }, + define: { + "import.meta.env.VITE_APP_VERSION": JSON.stringify("0.0.0-selfhost"), + "import.meta.env.VITE_GITHUB_URL": JSON.stringify("https://github.com/RhysSullivan/executor"), + "process.env.NODE_ENV": JSON.stringify(process.env.NODE_ENV ?? "development"), + }, + server: { + port: DEV_PORT, + fs: { allow: [fileURLToPath(new URL("../../", import.meta.url))] }, + }, + plugins: [ + executorApiPlugin(), + tailwindcss(), + executorVitePlugin({ + configPath: fileURLToPath(new URL("./executor.config.ts", import.meta.url)), + }), + tanstackRouter({ + target: "react", + autoCodeSplitting: true, + routesDirectory: fileURLToPath(new URL("./web/routes", import.meta.url)), + generatedRouteTree: fileURLToPath(new URL("./web/routeTree.gen.ts", import.meta.url)), + }), + ...react(), + ], +}); diff --git a/apps/host-selfhost/vitest.config.ts b/apps/host-selfhost/vitest.config.ts new file mode 100644 index 000000000..5bfa2d586 --- /dev/null +++ b/apps/host-selfhost/vitest.config.ts @@ -0,0 +1,8 @@ +import { defineConfig } from "vitest/config"; + +export default defineConfig({ + test: { + include: ["src/**/*.test.ts"], + passWithNoTests: true, + }, +}); diff --git a/apps/host-selfhost/web/auth-client.ts b/apps/host-selfhost/web/auth-client.ts new file mode 100644 index 000000000..1a9da926a --- /dev/null +++ b/apps/host-selfhost/web/auth-client.ts @@ -0,0 +1,9 @@ +import { createAuthClient } from "better-auth/react"; + +// Better Auth browser client. Talks to the self-host server's /api/auth (same +// origin); the session cookie it sets is what the shared AuthProvider's +// /account/me query and all API calls authenticate with. Only the login form +// and sign-out use this — auth STATE comes from the shared AuthProvider. +export const authClient = createAuthClient({ + baseURL: `${window.location.origin}/api/auth`, +}); diff --git a/apps/host-selfhost/web/entry-client.tsx b/apps/host-selfhost/web/entry-client.tsx new file mode 100644 index 000000000..816855e72 --- /dev/null +++ b/apps/host-selfhost/web/entry-client.tsx @@ -0,0 +1,15 @@ +import ReactDOM from "react-dom/client"; +import { RouterProvider } from "@tanstack/react-router"; + +import "@executor-js/react/globals.css"; + +import { getRouter } from "./router"; + +// The whole app — shell, pages, and the Better-Auth-gated multiplayer surface — +// is the shared @executor-js/react composition wired in routes/__root.tsx. +const router = getRouter(); +const rootElement = document.getElementById("root"); + +if (rootElement) { + ReactDOM.createRoot(rootElement).render(); +} diff --git a/apps/host-selfhost/web/index.html b/apps/host-selfhost/web/index.html new file mode 100644 index 000000000..5e34d435f --- /dev/null +++ b/apps/host-selfhost/web/index.html @@ -0,0 +1,22 @@ + + + + + + + + + + Executor (self-hosted) + + + + + +
+ + + diff --git a/apps/host-selfhost/web/login.tsx b/apps/host-selfhost/web/login.tsx new file mode 100644 index 000000000..ac88a22ed --- /dev/null +++ b/apps/host-selfhost/web/login.tsx @@ -0,0 +1,109 @@ +import { useState, type FormEvent } from "react"; + +import { Button } from "@executor-js/react/components/button"; +import { Input } from "@executor-js/react/components/input"; +import { Label } from "@executor-js/react/components/label"; + +import { authClient } from "./auth-client"; + +// Self-host login: email + password sign-in / sign-up via Better Auth. On +// success we reload so the shared AuthProvider re-reads /account/me and the +// AuthGate swaps in the app. (Cloud's equivalent is a WorkOS redirect — this +// is the provider-specific piece injected into the shared shell.) +export const LoginPage = () => { + const [mode, setMode] = useState<"signin" | "signup">("signin"); + const [name, setName] = useState(""); + const [email, setEmail] = useState(""); + const [password, setPassword] = useState(""); + const [error, setError] = useState(null); + const [busy, setBusy] = useState(false); + + const submit = async (event: FormEvent) => { + event.preventDefault(); + setBusy(true); + setError(null); + const result = + mode === "signin" + ? await authClient.signIn.email({ email, password }) + : await authClient.signUp.email({ email, password, name }); + if (result.error) { + setBusy(false); + setError(result.error.message ?? (mode === "signin" ? "Sign in failed" : "Sign up failed")); + return; + } + window.location.href = "/"; + }; + + return ( +
+
+
+

Executor

+

+ {mode === "signin" ? "Sign in to your instance" : "Create your account"} +

+
+ + {mode === "signup" && ( +
+ + setName((e.target as HTMLInputElement).value)} + autoComplete="name" + required + /> +
+ )} +
+ + setEmail((e.target as HTMLInputElement).value)} + autoComplete="email" + required + /> +
+
+ + setPassword((e.target as HTMLInputElement).value)} + autoComplete={mode === "signin" ? "current-password" : "new-password"} + required + minLength={8} + /> +
+ + {error &&

{error}

} + + + + +
+
+ ); +}; diff --git a/apps/host-selfhost/web/routeTree.gen.ts b/apps/host-selfhost/web/routeTree.gen.ts new file mode 100644 index 000000000..675d169fc --- /dev/null +++ b/apps/host-selfhost/web/routeTree.gen.ts @@ -0,0 +1,252 @@ +/* eslint-disable */ + +// @ts-nocheck + +// noinspection JSUnusedGlobalSymbols + +// This file was automatically generated by TanStack Router. +// You should NOT make any changes in this file as it will be overwritten. +// Additionally, you should also exclude this file from your linter and/or formatter to prevent it from being checked or modified. + +import { Route as rootRouteImport } from './routes/__root' +import { Route as ToolsRouteImport } from './routes/tools' +import { Route as SecretsRouteImport } from './routes/secrets' +import { Route as PoliciesRouteImport } from './routes/policies' +import { Route as ConnectionsRouteImport } from './routes/connections' +import { Route as ApiKeysRouteImport } from './routes/api-keys' +import { Route as IndexRouteImport } from './routes/index' +import { Route as SourcesNamespaceRouteImport } from './routes/sources.$namespace' +import { Route as ResumeExecutionIdRouteImport } from './routes/resume.$executionId' +import { Route as SourcesAddPluginKeyRouteImport } from './routes/sources.add.$pluginKey' +import { Route as PluginsPluginIdSplatRouteImport } from './routes/plugins.$pluginId.$' + +const ToolsRoute = ToolsRouteImport.update({ + id: '/tools', + path: '/tools', + getParentRoute: () => rootRouteImport, +} as any) +const SecretsRoute = SecretsRouteImport.update({ + id: '/secrets', + path: '/secrets', + getParentRoute: () => rootRouteImport, +} as any) +const PoliciesRoute = PoliciesRouteImport.update({ + id: '/policies', + path: '/policies', + getParentRoute: () => rootRouteImport, +} as any) +const ConnectionsRoute = ConnectionsRouteImport.update({ + id: '/connections', + path: '/connections', + getParentRoute: () => rootRouteImport, +} as any) +const ApiKeysRoute = ApiKeysRouteImport.update({ + id: '/api-keys', + path: '/api-keys', + getParentRoute: () => rootRouteImport, +} as any) +const IndexRoute = IndexRouteImport.update({ + id: '/', + path: '/', + getParentRoute: () => rootRouteImport, +} as any) +const SourcesNamespaceRoute = SourcesNamespaceRouteImport.update({ + id: '/sources/$namespace', + path: '/sources/$namespace', + getParentRoute: () => rootRouteImport, +} as any) +const ResumeExecutionIdRoute = ResumeExecutionIdRouteImport.update({ + id: '/resume/$executionId', + path: '/resume/$executionId', + getParentRoute: () => rootRouteImport, +} as any) +const SourcesAddPluginKeyRoute = SourcesAddPluginKeyRouteImport.update({ + id: '/sources/add/$pluginKey', + path: '/sources/add/$pluginKey', + getParentRoute: () => rootRouteImport, +} as any) +const PluginsPluginIdSplatRoute = PluginsPluginIdSplatRouteImport.update({ + id: '/plugins/$pluginId/$', + path: '/plugins/$pluginId/$', + getParentRoute: () => rootRouteImport, +} as any) + +export interface FileRoutesByFullPath { + '/': typeof IndexRoute + '/api-keys': typeof ApiKeysRoute + '/connections': typeof ConnectionsRoute + '/policies': typeof PoliciesRoute + '/secrets': typeof SecretsRoute + '/tools': typeof ToolsRoute + '/resume/$executionId': typeof ResumeExecutionIdRoute + '/sources/$namespace': typeof SourcesNamespaceRoute + '/plugins/$pluginId/$': typeof PluginsPluginIdSplatRoute + '/sources/add/$pluginKey': typeof SourcesAddPluginKeyRoute +} +export interface FileRoutesByTo { + '/': typeof IndexRoute + '/api-keys': typeof ApiKeysRoute + '/connections': typeof ConnectionsRoute + '/policies': typeof PoliciesRoute + '/secrets': typeof SecretsRoute + '/tools': typeof ToolsRoute + '/resume/$executionId': typeof ResumeExecutionIdRoute + '/sources/$namespace': typeof SourcesNamespaceRoute + '/plugins/$pluginId/$': typeof PluginsPluginIdSplatRoute + '/sources/add/$pluginKey': typeof SourcesAddPluginKeyRoute +} +export interface FileRoutesById { + __root__: typeof rootRouteImport + '/': typeof IndexRoute + '/api-keys': typeof ApiKeysRoute + '/connections': typeof ConnectionsRoute + '/policies': typeof PoliciesRoute + '/secrets': typeof SecretsRoute + '/tools': typeof ToolsRoute + '/resume/$executionId': typeof ResumeExecutionIdRoute + '/sources/$namespace': typeof SourcesNamespaceRoute + '/plugins/$pluginId/$': typeof PluginsPluginIdSplatRoute + '/sources/add/$pluginKey': typeof SourcesAddPluginKeyRoute +} +export interface FileRouteTypes { + fileRoutesByFullPath: FileRoutesByFullPath + fullPaths: + | '/' + | '/api-keys' + | '/connections' + | '/policies' + | '/secrets' + | '/tools' + | '/resume/$executionId' + | '/sources/$namespace' + | '/plugins/$pluginId/$' + | '/sources/add/$pluginKey' + fileRoutesByTo: FileRoutesByTo + to: + | '/' + | '/api-keys' + | '/connections' + | '/policies' + | '/secrets' + | '/tools' + | '/resume/$executionId' + | '/sources/$namespace' + | '/plugins/$pluginId/$' + | '/sources/add/$pluginKey' + id: + | '__root__' + | '/' + | '/api-keys' + | '/connections' + | '/policies' + | '/secrets' + | '/tools' + | '/resume/$executionId' + | '/sources/$namespace' + | '/plugins/$pluginId/$' + | '/sources/add/$pluginKey' + fileRoutesById: FileRoutesById +} +export interface RootRouteChildren { + IndexRoute: typeof IndexRoute + ApiKeysRoute: typeof ApiKeysRoute + ConnectionsRoute: typeof ConnectionsRoute + PoliciesRoute: typeof PoliciesRoute + SecretsRoute: typeof SecretsRoute + ToolsRoute: typeof ToolsRoute + ResumeExecutionIdRoute: typeof ResumeExecutionIdRoute + SourcesNamespaceRoute: typeof SourcesNamespaceRoute + PluginsPluginIdSplatRoute: typeof PluginsPluginIdSplatRoute + SourcesAddPluginKeyRoute: typeof SourcesAddPluginKeyRoute +} + +declare module '@tanstack/react-router' { + interface FileRoutesByPath { + '/tools': { + id: '/tools' + path: '/tools' + fullPath: '/tools' + preLoaderRoute: typeof ToolsRouteImport + parentRoute: typeof rootRouteImport + } + '/secrets': { + id: '/secrets' + path: '/secrets' + fullPath: '/secrets' + preLoaderRoute: typeof SecretsRouteImport + parentRoute: typeof rootRouteImport + } + '/policies': { + id: '/policies' + path: '/policies' + fullPath: '/policies' + preLoaderRoute: typeof PoliciesRouteImport + parentRoute: typeof rootRouteImport + } + '/connections': { + id: '/connections' + path: '/connections' + fullPath: '/connections' + preLoaderRoute: typeof ConnectionsRouteImport + parentRoute: typeof rootRouteImport + } + '/api-keys': { + id: '/api-keys' + path: '/api-keys' + fullPath: '/api-keys' + preLoaderRoute: typeof ApiKeysRouteImport + parentRoute: typeof rootRouteImport + } + '/': { + id: '/' + path: '/' + fullPath: '/' + preLoaderRoute: typeof IndexRouteImport + parentRoute: typeof rootRouteImport + } + '/sources/$namespace': { + id: '/sources/$namespace' + path: '/sources/$namespace' + fullPath: '/sources/$namespace' + preLoaderRoute: typeof SourcesNamespaceRouteImport + parentRoute: typeof rootRouteImport + } + '/resume/$executionId': { + id: '/resume/$executionId' + path: '/resume/$executionId' + fullPath: '/resume/$executionId' + preLoaderRoute: typeof ResumeExecutionIdRouteImport + parentRoute: typeof rootRouteImport + } + '/sources/add/$pluginKey': { + id: '/sources/add/$pluginKey' + path: '/sources/add/$pluginKey' + fullPath: '/sources/add/$pluginKey' + preLoaderRoute: typeof SourcesAddPluginKeyRouteImport + parentRoute: typeof rootRouteImport + } + '/plugins/$pluginId/$': { + id: '/plugins/$pluginId/$' + path: '/plugins/$pluginId/$' + fullPath: '/plugins/$pluginId/$' + preLoaderRoute: typeof PluginsPluginIdSplatRouteImport + parentRoute: typeof rootRouteImport + } + } +} + +const rootRouteChildren: RootRouteChildren = { + IndexRoute: IndexRoute, + ApiKeysRoute: ApiKeysRoute, + ConnectionsRoute: ConnectionsRoute, + PoliciesRoute: PoliciesRoute, + SecretsRoute: SecretsRoute, + ToolsRoute: ToolsRoute, + ResumeExecutionIdRoute: ResumeExecutionIdRoute, + SourcesNamespaceRoute: SourcesNamespaceRoute, + PluginsPluginIdSplatRoute: PluginsPluginIdSplatRoute, + SourcesAddPluginKeyRoute: SourcesAddPluginKeyRoute, +} +export const routeTree = rootRouteImport + ._addFileChildren(rootRouteChildren) + ._addFileTypes() diff --git a/apps/host-selfhost/web/router.tsx b/apps/host-selfhost/web/router.tsx new file mode 100644 index 000000000..0d1f42651 --- /dev/null +++ b/apps/host-selfhost/web/router.tsx @@ -0,0 +1,10 @@ +import { createRouter } from "@tanstack/react-router"; + +import { routeTree } from "./routeTree.gen"; + +export const getRouter = () => + createRouter({ + routeTree, + scrollRestoration: true, + defaultPreloadStaleTime: 0, + }); diff --git a/apps/host-selfhost/web/routes/__root.tsx b/apps/host-selfhost/web/routes/__root.tsx new file mode 100644 index 000000000..969e6a62c --- /dev/null +++ b/apps/host-selfhost/web/routes/__root.tsx @@ -0,0 +1,58 @@ +import { createRootRoute } from "@tanstack/react-router"; +import type { ReactNode } from "react"; + +import { ExecutorProvider } from "@executor-js/react/api/provider"; +import { ExecutorPluginsProvider } from "@executor-js/sdk/client"; +import { Toaster } from "@executor-js/react/components/sonner"; +import { AuthProvider, useAuth } from "@executor-js/react/multiplayer/auth-context"; +import { Shell, defaultShellNavItems } from "@executor-js/react/multiplayer/shell"; +import { plugins as clientPlugins } from "virtual:executor/plugins-client"; + +import { authClient } from "../auth-client"; +import { LoginPage } from "../login"; + +// --------------------------------------------------------------------------- +// Self-host root: the SHARED multiplayer composition with Better Auth as the +// provider. Same shell, pages, and account surface as cloud — the only +// self-host specifics are the login form (email/password) and sign-out (Better +// Auth), injected here. No billing, Sentry, or PostHog. +// --------------------------------------------------------------------------- + +export const Route = createRootRoute({ + component: RootComponent, +}); + +const signOut = async () => { + await authClient.signOut(); + window.location.href = "/"; +}; + +function AuthGate({ children }: { children: ReactNode }) { + const auth = useAuth(); + if (auth.status === "loading") { + return ( +
+ Loading… +
+ ); + } + if (auth.status === "unauthenticated") { + return ; + } + return <>{children}; +} + +function RootComponent() { + return ( + + + + + + + + + + + ); +} diff --git a/apps/host-selfhost/web/routes/api-keys.tsx b/apps/host-selfhost/web/routes/api-keys.tsx new file mode 100644 index 000000000..b563862d7 --- /dev/null +++ b/apps/host-selfhost/web/routes/api-keys.tsx @@ -0,0 +1,6 @@ +import { createFileRoute } from "@tanstack/react-router"; +import { ApiKeysPage } from "@executor-js/react/pages/api-keys"; + +export const Route = createFileRoute("/api-keys")({ + component: ApiKeysPage, +}); diff --git a/apps/host-selfhost/web/routes/connections.tsx b/apps/host-selfhost/web/routes/connections.tsx new file mode 100644 index 000000000..ae9f0af5a --- /dev/null +++ b/apps/host-selfhost/web/routes/connections.tsx @@ -0,0 +1,6 @@ +import { createFileRoute } from "@tanstack/react-router"; +import { ConnectionsPage } from "@executor-js/react/pages/connections"; + +export const Route = createFileRoute("/connections")({ + component: () => , +}); diff --git a/apps/host-selfhost/web/routes/index.tsx b/apps/host-selfhost/web/routes/index.tsx new file mode 100644 index 000000000..01273b87a --- /dev/null +++ b/apps/host-selfhost/web/routes/index.tsx @@ -0,0 +1,6 @@ +import { createFileRoute } from "@tanstack/react-router"; +import { SourcesPage } from "@executor-js/react/pages/sources"; + +export const Route = createFileRoute("/")({ + component: SourcesPage, +}); diff --git a/apps/host-selfhost/web/routes/plugins.$pluginId.$.tsx b/apps/host-selfhost/web/routes/plugins.$pluginId.$.tsx new file mode 100644 index 000000000..64f59a40a --- /dev/null +++ b/apps/host-selfhost/web/routes/plugins.$pluginId.$.tsx @@ -0,0 +1,31 @@ +import { createFileRoute, notFound } from "@tanstack/react-router"; +import { useClientPlugins } from "@executor-js/sdk/client"; + +// /plugins// — mounts pages contributed by client plugins, +// materialised from `virtual:executor/plugins-client` via the root's +// ExecutorPluginsProvider. Adding a plugin to executor.config.ts is enough. + +export const Route = createFileRoute("/plugins/$pluginId/$")({ + component: PluginRouteComponent, +}); + +function normalizePath(input: string): string { + if (!input || input === "/") return "/"; + return input.startsWith("/") ? input : `/${input}`; +} + +function PluginRouteComponent() { + const { pluginId, _splat: rest } = Route.useParams(); + const plugins = useClientPlugins(); + const plugin = plugins.find((p) => p.id === pluginId); + // oxlint-disable-next-line executor/no-try-catch-or-throw -- boundary: TanStack Router represents not-found from components by throwing notFound() + if (!plugin) throw notFound(); + + const target = normalizePath(rest ?? "/"); + const page = plugin.pages?.find((p) => normalizePath(p.path) === target); + // oxlint-disable-next-line executor/no-try-catch-or-throw -- boundary: TanStack Router represents not-found from components by throwing notFound() + if (!page) throw notFound(); + + const Component = page.component; + return ; +} diff --git a/apps/host-selfhost/web/routes/policies.tsx b/apps/host-selfhost/web/routes/policies.tsx new file mode 100644 index 000000000..a9de9ff6f --- /dev/null +++ b/apps/host-selfhost/web/routes/policies.tsx @@ -0,0 +1,6 @@ +import { createFileRoute } from "@tanstack/react-router"; +import { PoliciesPage } from "@executor-js/react/pages/policies"; + +export const Route = createFileRoute("/policies")({ + component: () => , +}); diff --git a/apps/host-selfhost/web/routes/resume.$executionId.tsx b/apps/host-selfhost/web/routes/resume.$executionId.tsx new file mode 100644 index 000000000..32a84347b --- /dev/null +++ b/apps/host-selfhost/web/routes/resume.$executionId.tsx @@ -0,0 +1,117 @@ +import { useCallback } from "react"; +import { useAtomSet, useAtomValue } from "@effect/atom-react"; +import { Data, Effect, Option, Schema } from "effect"; +import * as Atom from "effect/unstable/reactivity/Atom"; +import { createFileRoute } from "@tanstack/react-router"; +import { + ResumeApprovalPage, + ResumeApprovalPageView, +} from "@executor-js/react/pages/resume-approval"; +import { pausedExecutionAtom } from "@executor-js/react/api/atoms"; +import type { ElicitationAction } from "@executor-js/react/components/elicitation-approval"; + +const SearchParams = Schema.toStandardSchemaV1( + Schema.Struct({ + mcp_session_id: Schema.optional(Schema.String), + }), +); +const LocalMcpResumeCompleted = Schema.Struct({ + status: Schema.Literal("completed"), + text: Schema.String, + structured: Schema.Unknown, + isError: Schema.Boolean, +}); +const LocalMcpResumePaused = Schema.Struct({ + status: Schema.Literal("paused"), + text: Schema.String, + structured: Schema.Unknown, +}); +const LocalMcpResumeResult = Schema.Union([LocalMcpResumeCompleted, LocalMcpResumePaused]); +const decodeLocalMcpResumeResult = Schema.decodeUnknownOption(LocalMcpResumeResult); + +class LocalMcpResumeError extends Data.TaggedError("LocalMcpResumeError")<{ + readonly message: string; +}> {} + +type LocalMcpResumeInput = { + readonly mcpSessionId: string; + readonly executionId: string; + readonly action: ElicitationAction; + readonly content?: Record; +}; + +const resumeLocalMcpExecution = Atom.fn()((input) => + Effect.gen(function* () { + const response = yield* Effect.tryPromise({ + try: () => + fetch( + `/api/mcp-sessions/${encodeURIComponent(input.mcpSessionId)}/executions/${encodeURIComponent(input.executionId)}/resume`, + { + method: "POST", + headers: { "content-type": "application/json" }, + body: JSON.stringify( + input.action === "accept" + ? { action: input.action, content: input.content ?? {} } + : { action: input.action }, + ), + }, + ), + catch: () => new LocalMcpResumeError({ message: "Failed to submit approval." }), + }); + + if (!response.ok) { + const body = yield* Effect.tryPromise({ + try: () => response.text(), + catch: () => "", + }).pipe(Effect.orElseSucceed(() => "")); + return yield* new LocalMcpResumeError({ + message: body || `Approval request failed (${response.status}).`, + }); + } + + const body = yield* Effect.tryPromise({ + try: () => response.json(), + catch: () => new LocalMcpResumeError({ message: "Approval response was not valid JSON." }), + }); + const result = decodeLocalMcpResumeResult(body); + if (Option.isNone(result)) { + return yield* new LocalMcpResumeError({ + message: "Approval response had an unexpected shape.", + }); + } + return result.value; + }), +); + +export const Route = createFileRoute("/resume/$executionId")({ + validateSearch: SearchParams, + component: RouteComponent, +}); + +function RouteComponent() { + const { executionId } = Route.useParams(); + const { mcp_session_id: mcpSessionId } = Route.useSearch(); + if (mcpSessionId) { + return ; + } + return ; +} + +function LocalMcpResumeApproval(props: { executionId: string; mcpSessionId: string }) { + const paused = useAtomValue(pausedExecutionAtom(props.executionId)); + const doResume = useAtomSet(resumeLocalMcpExecution, { mode: "promiseExit" }); + const resume = useCallback( + (executionId: string, action: ElicitationAction, content?: Record) => + doResume({ mcpSessionId: props.mcpSessionId, executionId, action, content }), + [doResume, props.mcpSessionId], + ); + + return ( + + ); +} diff --git a/apps/host-selfhost/web/routes/secrets.tsx b/apps/host-selfhost/web/routes/secrets.tsx new file mode 100644 index 000000000..190789172 --- /dev/null +++ b/apps/host-selfhost/web/routes/secrets.tsx @@ -0,0 +1,23 @@ +import { Schema } from "effect"; +import { createFileRoute } from "@tanstack/react-router"; +import { SecretsPage } from "@executor-js/react/pages/secrets"; + +// Query params from the agent-facing `secrets.create` static tool: it builds a +// URL like `/secrets?name=…&scope=…&secretId=…`; open the add modal pre-filled. +const SearchParams = Schema.toStandardSchemaV1( + Schema.Struct({ + name: Schema.optional(Schema.String), + secretId: Schema.optional(Schema.String), + provider: Schema.optional(Schema.String), + scope: Schema.optional(Schema.String), + }), +); + +export const Route = createFileRoute("/secrets")({ + validateSearch: SearchParams, + component: () => { + const { name, secretId, provider, scope } = Route.useSearch(); + const hasPrefill = name != null || secretId != null; + return ; + }, +}); diff --git a/apps/host-selfhost/web/routes/sources.$namespace.tsx b/apps/host-selfhost/web/routes/sources.$namespace.tsx new file mode 100644 index 000000000..2bcdcce73 --- /dev/null +++ b/apps/host-selfhost/web/routes/sources.$namespace.tsx @@ -0,0 +1,9 @@ +import { createFileRoute } from "@tanstack/react-router"; +import { SourceDetailPage } from "@executor-js/react/pages/source-detail"; + +export const Route = createFileRoute("/sources/$namespace")({ + component: () => { + const { namespace } = Route.useParams(); + return ; + }, +}); diff --git a/apps/host-selfhost/web/routes/sources.add.$pluginKey.tsx b/apps/host-selfhost/web/routes/sources.add.$pluginKey.tsx new file mode 100644 index 000000000..48d58b32d --- /dev/null +++ b/apps/host-selfhost/web/routes/sources.add.$pluginKey.tsx @@ -0,0 +1,20 @@ +import { Schema } from "effect"; +import { createFileRoute } from "@tanstack/react-router"; +import { SourcesAddPage } from "@executor-js/react/pages/sources-add"; + +const SearchParams = Schema.toStandardSchemaV1( + Schema.Struct({ + url: Schema.optional(Schema.String), + preset: Schema.optional(Schema.String), + namespace: Schema.optional(Schema.String), + }), +); + +export const Route = createFileRoute("/sources/add/$pluginKey")({ + validateSearch: SearchParams, + component: () => { + const { pluginKey } = Route.useParams(); + const { url, preset, namespace } = Route.useSearch(); + return ; + }, +}); diff --git a/apps/host-selfhost/web/routes/tools.tsx b/apps/host-selfhost/web/routes/tools.tsx new file mode 100644 index 000000000..25929fd2b --- /dev/null +++ b/apps/host-selfhost/web/routes/tools.tsx @@ -0,0 +1,6 @@ +import { createFileRoute } from "@tanstack/react-router"; +import { ToolsPage } from "@executor-js/react/pages/tools"; + +export const Route = createFileRoute("/tools")({ + component: ToolsPage, +}); diff --git a/apps/local/package.json b/apps/local/package.json index 72e79a4e5..e0b1c78ea 100644 --- a/apps/local/package.json +++ b/apps/local/package.json @@ -39,6 +39,7 @@ "@executor-js/runtime-quickjs": "workspace:*", "@executor-js/sdk": "workspace:*", "@executor-js/vite-plugin": "workspace:*", + "@libsql/client": "catalog:", "@modelcontextprotocol/sdk": "^1.12.1", "@tanstack/react-router": "catalog:", "drizzle-orm": "catalog:", diff --git a/apps/local/src/server/__test-helpers__/libsql-test-db.ts b/apps/local/src/server/__test-helpers__/libsql-test-db.ts new file mode 100644 index 000000000..45242f8e1 --- /dev/null +++ b/apps/local/src/server/__test-helpers__/libsql-test-db.ts @@ -0,0 +1,100 @@ +import { createClient, type Client, type InArgs, type Row } from "@libsql/client"; +import { drizzle } from "drizzle-orm/libsql"; +import { migrate } from "drizzle-orm/libsql/migrator"; +import { resolve } from "node:path"; + +// --------------------------------------------------------------------------- +// Async libSQL test helper for the local migration/import suites. These tests +// used to open a synchronous bun:sqlite `Database` and call +// `.exec(sql)` / `.prepare(sql).run(...args)` / `.get(...args)` / `.all(...args)`. +// libSQL is async, so this thin wrapper keeps the same call shape (just awaited) +// over a single libSQL connection to the same `file:` URL — letting the suites +// run under plain Node vitest with no bun:sqlite dependency. +// --------------------------------------------------------------------------- + +const toUrl = (path: string): string => (path === ":memory:" ? path : `file:${resolve(path)}`); + +export class LibsqlTestDb { + readonly client: Client; + + constructor(path: string = ":memory:") { + this.client = createClient({ url: toUrl(path) }); + } + + /** Run one or more `;`-separated statements (bun:sqlite `.exec`). */ + async exec(sql: string): Promise { + await this.client.executeMultiple(sql); + } + + /** Run a parameterized statement (bun:sqlite `.prepare(sql).run(...args)`). */ + async run(sql: string, ...args: unknown[]): Promise { + await this.client.execute({ sql, args: args as InArgs }); + } + + /** First row of a query (bun:sqlite `.prepare(sql).get(...args)`), or undefined. */ + async get(sql: string, ...args: unknown[]): Promise { + return (await this.client.execute({ sql, args: args as InArgs })).rows[0] as T | undefined; + } + + /** All rows of a query (bun:sqlite `.prepare(sql).all(...args)`). */ + async all(sql: string, ...args: unknown[]): Promise { + // oxlint-disable-next-line executor/no-double-cast -- boundary: test helper narrows libSQL's structural `Row[]` to the caller's row type (the SQL is the contract) + return (await this.client.execute({ sql, args: args as InArgs })).rows as unknown as T[]; + } + + /** + * Prepared-statement shape mirroring bun:sqlite's `.prepare(sql)` so existing + * suites keep their `.run(...) / .get(...) / .all(...)` chains (just awaited). + */ + prepare(sql: string): LibsqlPreparedStatement { + return new LibsqlPreparedStatement(this.client, sql); + } + + close(): void { + this.client.close(); + } +} + +export class LibsqlPreparedStatement { + constructor( + private readonly client: Client, + private readonly sql: string, + ) {} + + async run(...args: unknown[]): Promise { + await this.client.execute({ sql: this.sql, args: args as InArgs }); + } + + async get(...args: unknown[]): Promise { + return (await this.client.execute({ sql: this.sql, args: args as InArgs })).rows[0] as + | T + | undefined; + } + + async all(...args: unknown[]): Promise { + // oxlint-disable-next-line executor/no-double-cast -- boundary: test helper narrows libSQL's structural `Row[]` to the caller's row type (the SQL is the contract) + return (await this.client.execute({ sql: this.sql, args: args as InArgs })) + .rows as unknown as T[]; + } +} + +/** Open a fresh in-memory or file-backed libSQL test DB. */ +export const openTestDb = (path?: string): LibsqlTestDb => new LibsqlTestDb(path); + +/** Open a libSQL client for a file path (caller closes it). */ +export const openTestClient = (path: string): Client => createClient({ url: toUrl(path) }); + +/** + * Replays drizzle migrations against a file DB through the libSQL migrator + * (replaces `migrate(drizzle(new Database(path)), { migrationsFolder })`). Opens + * and closes its own connection. + */ +export const runMigrations = async (path: string, migrationsFolder: string): Promise => { + const client = createClient({ url: toUrl(path) }); + // oxlint-disable-next-line executor/no-try-catch-or-throw -- boundary: test migrator must close its connection whether or not the migration throws + try { + await migrate(drizzle({ client }), { migrationsFolder }); + } finally { + client.close(); + } +}; diff --git a/apps/local/src/server/__test-helpers__/pre-0007-schema.ts b/apps/local/src/server/__test-helpers__/pre-0007-schema.ts index ebe50ea3c..b4e44a3b3 100644 --- a/apps/local/src/server/__test-helpers__/pre-0007-schema.ts +++ b/apps/local/src/server/__test-helpers__/pre-0007-schema.ts @@ -3,7 +3,7 @@ // after 0006_neat_terror), then runs drizzle's migrator which executes // only `0007_normalize_plugin_secret_refs.sql` thanks to the stamp. -import { Database } from "bun:sqlite"; +import { type LibsqlTestDb } from "./libsql-test-db"; export const PRE_0007_SQL = ` CREATE TABLE __drizzle_migrations ( @@ -131,8 +131,9 @@ export const PRE_0007_SQL = ` // folderMillis (from the journal) is <= that timestamp. export const STAMP_BEFORE = 1777850000001; -export const stampPriorMigrationsApplied = (db: Database) => { - db.prepare("INSERT INTO __drizzle_migrations (hash, created_at) VALUES (?, ?)").run( +export const stampPriorMigrationsApplied = async (db: LibsqlTestDb): Promise => { + await db.run( + "INSERT INTO __drizzle_migrations (hash, created_at) VALUES (?, ?)", "pre-0007-marker", STAMP_BEFORE, ); diff --git a/apps/local/src/server/app.ts b/apps/local/src/server/app.ts new file mode 100644 index 000000000..f9bddc6e8 --- /dev/null +++ b/apps/local/src/server/app.ts @@ -0,0 +1,122 @@ +import { HttpApiSwagger } from "effect/unstable/httpapi"; +import { Layer } from "effect"; + +import { + composePluginApi, + ExecutorApp, + FixedExecutionProvider, + textFailureStrategy, +} from "@executor-js/api/server"; +import { createExecutionEngine } from "@executor-js/execution"; +import { makeQuickJsExecutor } from "@executor-js/runtime-quickjs"; + +import { getExecutorBundle, type LocalExecutor } from "./executor"; +import { localIdentityLayer } from "./identity"; +import { ErrorCaptureLive } from "./observability"; + +// =========================================================================== +// The LOCAL Executor app, as ONE `ExecutorApp.make` call. +// +// The whole scenario in 60 seconds: single-user identity (always the one local +// Principal) over a SINGLE boot-built executor scoped to the working directory +// (`-`, with `oauthEndpointUrlPolicy: { allowHttp: true }`), +// QuickJS in-process code execution, console error capture, Swagger at /docs — +// and NO account API, NO usage metering. `diff` against +// `apps/host-selfhost/src/app.ts` is the whole product difference: local serves +// its ONE cwd executor directly (the `fixedExecution` seam) instead of building +// a per-request `[user-org:…, org]` scoped executor from identity. +// +// `ExecutorApp.make` owns the assembly (the fixed-execution middleware wrapping +// the protected API, the extension routes, provideMerge(boot)). This file's job +// is the eager async boot — building the ONE executor + engine — and slotting +// local's seam Layers into the named slots. +// +// What legitimately stays LOCAL-PLATFORM (the thin `serve.ts` Bun shell, NOT +// make()'s job): the socket binding + idleTimeout, static SPA serving (embedded +// /disk/dev-vite), the one-time legacy SQLite import (run inside the boot bundle, +// BEFORE the executor reaches this seam), the single-credential network gate, the +// /mcp + /api/mcp-sessions resume + /api/oauth/await routes (an in-process, +// single-engine MCP handler with a browser-approval store — local's own surface, +// not the shared multi-user McpServingRoutes envelope), and the `/api`-prefix +// stripping. So `mcp` and `account` are OMITTED, and `mountPrefix` is left at +// root (the Bun shell strips `/api` before the handler). +// =========================================================================== + +/** + * The fixed-execution seam: the ONE boot executor + engine + plugin extension + * map, projected under `FixedExecutionProvider`. The executor already holds its + * cwd scope, libSQL db handle, plugins, and `allowHttp` policy (built in + * `executor.ts`), so local supplies no `DbProvider`/`PluginsProvider`/ + * `HostConfig`/`CodeExecutorProvider` seams — the fixed executor is the whole + * execution model. + */ +const localFixedExecutionLayer = (executor: LocalExecutor): Layer.Layer => + Layer.succeed(FixedExecutionProvider)({ + executor, + engine: createExecutionEngine({ + executor, + codeExecutor: makeQuickJsExecutor(), + }), + // The executor IS its own plugin-extension map (`executor[pluginId]`); the + // fixed middleware reads `executor[id]` to satisfy each plugin's + // `*ExtensionService` Tag per request — identical binding to the prior + // `composePluginHandlers(plugins, executor)` boot-bind. + extensions: executor, + }); + +export interface LocalApiHandler { + /** The unified web handler: serves the typed API (at root — the Bun shell strips `/api`) + /docs. */ + readonly handler: (request: Request) => Promise; + readonly dispose: () => Promise; +} + +/** + * Build the local app's API web-handler. Awaits the shared boot bundle (the one + * cwd-scoped executor, after the legacy SQLite import), then composes + * `ExecutorApp.make` over local's seams and binds it to a `fetch`-style handler. + * + * Mirrors self-host's `makeSelfHostApiHandler`: production-unconditional wiring + * (no test-only branches), with `serve.ts`'s `handlers` injection hook as the + * test seam where a test wants to bypass the boot graph. + */ +export const makeLocalApiHandler = async (): Promise => { + const { executor, plugins } = await getExecutorBundle(); + + // Build the fixed-execution seam ONCE (one executor + one engine). The same + // Layer is the `fixedExecution` seam declaration AND lives in `boot` so the + // fixed middleware's residual `FixedExecutionProvider` resolves there — exactly + // as self-host declares `db: SelfHostDbProvider` and puts the handle in `boot`. + const fixedExecution = localFixedExecutionLayer(executor); + + const { toWebHandler } = ExecutorApp.make({ + plugins, + providers: { + // Single-user: always resolves the one local Principal (a real impl, not a + // placeholder). Boot-scoped (`RIdentity = never`), captured once. + identity: localIdentityLayer, + // The ONE boot executor + engine, served directly — local's fixed + // execution model (no per-request scoped-executor rebuild). + fixedExecution, + // account omitted (local has no account API). + // mcp omitted (local's /mcp is its own in-process surface in serve.ts). + errorCapture: ErrorCaptureLive, + }, + extensions: { + // Swagger UI at /docs, over the root-mounted spec (matches the served + // paths — local serves the API at root; the Bun shell strips `/api`). + routes: [HttpApiSwagger.layer(composePluginApi(plugins), { path: "/docs" })], + }, + // No mountPrefix: local serves the typed API at root and the Bun shell + // strips the `/api` prefix before dispatching here. Local renders identity + // failures as text (matching self-host); the single-user provider never + // produces one in practice. + config: { failure: textFailureStrategy }, + // The boot-scoped context provideMerge'd under everything: the identity + // provider (captured once by the fixed-execution middleware) + the fixed + // execution seam (the one executor + engine + extension map). + boot: Layer.merge(localIdentityLayer, fixedExecution), + }); + + const web = toWebHandler(); + return { handler: web.handler, dispose: web.dispose }; +}; diff --git a/apps/local/src/server/auth-tool-failures.test.ts b/apps/local/src/server/auth-tool-failures.test.ts index c779d6141..68b42b8fb 100644 --- a/apps/local/src/server/auth-tool-failures.test.ts +++ b/apps/local/src/server/auth-tool-failures.test.ts @@ -29,7 +29,12 @@ import { } from "effect/unstable/httpapi"; import { addGroup, observabilityMiddleware } from "@executor-js/api"; -import { CoreHandlers, ExecutionEngineService, ExecutorService } from "@executor-js/api/server"; +import { + CoreHandlers, + ExecutionEngineService, + ExecutorService, + collectTables, +} from "@executor-js/api/server"; import { createExecutionEngine } from "@executor-js/execution"; import { fileSecretsPlugin } from "@executor-js/plugin-file-secrets"; import { openApiPlugin } from "@executor-js/plugin-openapi"; @@ -40,7 +45,7 @@ import { } from "@executor-js/plugin-openapi/api"; import { makeOpenApiHttpApiTestAddSpecPayload } from "@executor-js/plugin-openapi/testing"; import { makeQuickJsExecutor } from "@executor-js/runtime-quickjs"; -import { Scope, ScopeId, collectTables, createExecutor } from "@executor-js/sdk"; +import { Scope, ScopeId, createExecutor } from "@executor-js/sdk"; import { ErrorCaptureLive } from "./observability"; import { createSqliteFumaDb } from "./sqlite-fumadb"; diff --git a/apps/local/src/server/db-upgrade.test.ts b/apps/local/src/server/db-upgrade.test.ts index 0a4c0aa58..af49e7038 100644 --- a/apps/local/src/server/db-upgrade.test.ts +++ b/apps/local/src/server/db-upgrade.test.ts @@ -5,13 +5,11 @@ // and preserve legacy secret routing rows for the fresh scoped database. import { afterEach, beforeEach, describe, expect, it } from "@effect/vitest"; -import { Database } from "bun:sqlite"; -import { drizzle } from "drizzle-orm/bun-sqlite"; -import { migrate } from "drizzle-orm/bun-sqlite/migrator"; import { existsSync, mkdtempSync, rmSync, writeFileSync } from "node:fs"; import { tmpdir } from "node:os"; import { join } from "node:path"; +import { openTestDb, runMigrations } from "./__test-helpers__/libsql-test-db"; import { importLegacySecrets, isPreScopeSchema, @@ -70,9 +68,9 @@ const SCOPED_SCHEMA = ` ); `; -const seed = (path: string, sql: string) => { - const db = new Database(path); - db.exec(sql); +const seed = async (path: string, sql: string) => { + const db = openTestDb(path); + await db.exec(sql); db.close(); }; @@ -87,37 +85,37 @@ afterEach(() => { }); describe("isPreScopeSchema", () => { - it("returns true for a DB with a source table missing scope_id", () => { + it("returns true for a DB with a source table missing scope_id", async () => { const path = join(workDir, "data.db"); - seed(path, PRE_SCOPE_SCHEMA); - expect(isPreScopeSchema(path)).toBe(true); + await seed(path, PRE_SCOPE_SCHEMA); + expect(await isPreScopeSchema(path)).toBe(true); }); - it("returns false for a DB whose source table already has scope_id", () => { + it("returns false for a DB whose source table already has scope_id", async () => { const path = join(workDir, "data.db"); - seed(path, SCOPED_SCHEMA); - expect(isPreScopeSchema(path)).toBe(false); + await seed(path, SCOPED_SCHEMA); + expect(await isPreScopeSchema(path)).toBe(false); }); - it("returns false for a DB with no source table", () => { + it("returns false for a DB with no source table", async () => { const path = join(workDir, "data.db"); - seed(path, "CREATE TABLE unrelated (x TEXT);"); - expect(isPreScopeSchema(path)).toBe(false); + await seed(path, "CREATE TABLE unrelated (x TEXT);"); + expect(await isPreScopeSchema(path)).toBe(false); }); - it("returns false when the DB file doesn't exist", () => { - expect(isPreScopeSchema(join(workDir, "missing.db"))).toBe(false); + it("returns false when the DB file doesn't exist", async () => { + expect(await isPreScopeSchema(join(workDir, "missing.db"))).toBe(false); }); }); describe("moveAsidePreScopeDb", () => { - it("renames data.db + wal/shm siblings and returns the backup path", () => { + it("renames data.db + wal/shm siblings and returns the backup path", async () => { const path = join(workDir, "data.db"); - seed(path, PRE_SCOPE_SCHEMA); + await seed(path, PRE_SCOPE_SCHEMA); writeFileSync(`${path}-wal`, "wal-bytes"); writeFileSync(`${path}-shm`, "shm-bytes"); - const backup = moveAsidePreScopeDb(path); + const backup = await moveAsidePreScopeDb(path); expect(backup).toMatch(/data\.db\.pre-scopes-\d+-[0-9a-f]{8}$/); expect(existsSync(path)).toBe(false); expect(existsSync(`${path}-wal`)).toBe(false); @@ -127,31 +125,29 @@ describe("moveAsidePreScopeDb", () => { expect(existsSync(`${backup}-shm`)).toBe(true); }); - it("is a no-op when the DB already has the scoped schema", () => { + it("is a no-op when the DB already has the scoped schema", async () => { const path = join(workDir, "data.db"); - seed(path, SCOPED_SCHEMA); - expect(moveAsidePreScopeDb(path)).toBeNull(); + await seed(path, SCOPED_SCHEMA); + expect(await moveAsidePreScopeDb(path)).toBeNull(); expect(existsSync(path)).toBe(true); }); - it("is a no-op when the DB doesn't exist yet", () => { - expect(moveAsidePreScopeDb(join(workDir, "missing.db"))).toBeNull(); + it("is a no-op when the DB doesn't exist yet", async () => { + expect(await moveAsidePreScopeDb(join(workDir, "missing.db"))).toBeNull(); }); }); describe("move-aside + fresh migrate end-to-end", () => { - it("lets migrations run cleanly after an old DB is moved aside", () => { + it("lets migrations run cleanly after an old DB is moved aside", async () => { const path = join(workDir, "data.db"); - seed(path, PRE_SCOPE_SCHEMA); + await seed(path, PRE_SCOPE_SCHEMA); - const backup = moveAsidePreScopeDb(path); + const backup = await moveAsidePreScopeDb(path); expect(backup).not.toBeNull(); - const db = new Database(path); - migrate(drizzle(db), { - migrationsFolder: join(import.meta.dirname, "../../drizzle"), - }); - const cols = db.prepare("PRAGMA table_info('source')").all() as ReadonlyArray<{ + await runMigrations(path, join(import.meta.dirname, "../../drizzle")); + const db = openTestDb(path); + const cols = (await db.prepare("PRAGMA table_info('source')").all()) as ReadonlyArray<{ readonly name: string; }>; db.close(); @@ -160,25 +156,19 @@ describe("move-aside + fresh migrate end-to-end", () => { }); describe("readLegacySecrets", () => { - it("returns all rows from a pre-scope DB's secret table", () => { + it("returns all rows from a pre-scope DB's secret table", async () => { const path = join(workDir, "data.db"); - seed(path, PRE_SCOPE_SCHEMA); - const db = new Database(path); - db.prepare("INSERT INTO secret (id, name, provider, created_at) VALUES (?, ?, ?, ?)").run( - "sec_1", - "GitHub Token", - "onepassword", - 1_700_000_000, - ); - db.prepare("INSERT INTO secret (id, name, provider, created_at) VALUES (?, ?, ?, ?)").run( - "sec_2", - "Stripe", - "keychain", - 1_700_000_001, - ); + await seed(path, PRE_SCOPE_SCHEMA); + const db = openTestDb(path); + await db + .prepare("INSERT INTO secret (id, name, provider, created_at) VALUES (?, ?, ?, ?)") + .run("sec_1", "GitHub Token", "onepassword", 1_700_000_000); + await db + .prepare("INSERT INTO secret (id, name, provider, created_at) VALUES (?, ?, ?, ?)") + .run("sec_2", "Stripe", "keychain", 1_700_000_001); db.close(); - const rows = readLegacySecrets(path); + const rows = await readLegacySecrets(path); expect(rows).toHaveLength(2); expect(rows[0]).toEqual({ id: "sec_1", @@ -188,21 +178,21 @@ describe("readLegacySecrets", () => { }); }); - it("returns [] when the DB has no secret table", () => { + it("returns [] when the DB has no secret table", async () => { const path = join(workDir, "data.db"); - seed(path, "CREATE TABLE unrelated (x TEXT);"); - expect(readLegacySecrets(path)).toEqual([]); + await seed(path, "CREATE TABLE unrelated (x TEXT);"); + expect(await readLegacySecrets(path)).toEqual([]); }); - it("returns [] when the DB file doesn't exist", () => { - expect(readLegacySecrets(join(workDir, "missing.db"))).toEqual([]); + it("returns [] when the DB file doesn't exist", async () => { + expect(await readLegacySecrets(join(workDir, "missing.db"))).toEqual([]); }); }); describe("importLegacySecrets", () => { - const createScopedDb = (path: string): Database => { - const db = new Database(path); - db.exec(` + const createScopedDb = async (path: string) => { + const db = openTestDb(path); + await db.exec(` CREATE TABLE secret ( id TEXT NOT NULL, scope_id TEXT NOT NULL, @@ -215,16 +205,16 @@ describe("importLegacySecrets", () => { return db; }; - it("inserts rows stamped with the given scope id", () => { + it("inserts rows stamped with the given scope id", async () => { const path = join(workDir, "data.db"); - const db = createScopedDb(path); - importLegacySecrets(db, "scope_a", [ + const db = await createScopedDb(path); + await importLegacySecrets(db.client, "scope_a", [ { id: "sec_1", name: "GH", provider: "onepassword", createdAt: 1 }, { id: "sec_2", name: "St", provider: "keychain", createdAt: 2 }, ]); - const rows = db + const rows = await db .prepare("SELECT id, scope_id, name, provider FROM secret ORDER BY id") - .all() as ReadonlyArray<{ id: string; scope_id: string; name: string; provider: string }>; + .all<{ id: string; scope_id: string; name: string; provider: string }>(); db.close(); expect(rows).toHaveLength(2); expect(rows[0]).toEqual({ @@ -236,29 +226,29 @@ describe("importLegacySecrets", () => { expect(rows[1].scope_id).toBe("scope_a"); }); - it("is a no-op with an empty list", () => { + it("is a no-op with an empty list", async () => { const path = join(workDir, "data.db"); - const db = createScopedDb(path); - importLegacySecrets(db, "scope_a", []); - const count = (db.prepare("SELECT COUNT(*) as n FROM secret").get() as { n: number }).n; + const db = await createScopedDb(path); + await importLegacySecrets(db.client, "scope_a", []); + const count = (await db.prepare("SELECT COUNT(*) as n FROM secret").get<{ n: number }>())?.n; db.close(); expect(count).toBe(0); }); - it("uses INSERT OR IGNORE so a second import of the same ids is a no-op", () => { + it("uses INSERT OR IGNORE so a second import of the same ids is a no-op", async () => { const path = join(workDir, "data.db"); - const db = createScopedDb(path); + const db = await createScopedDb(path); const rows = [{ id: "sec_1", name: "GH", provider: "onepassword", createdAt: 1 }]; - importLegacySecrets(db, "scope_a", rows); - db.prepare( - "UPDATE secret SET provider = 'file' WHERE id = 'sec_1' AND scope_id = 'scope_a'", - ).run(); - importLegacySecrets(db, "scope_a", rows); + await importLegacySecrets(db.client, "scope_a", rows); + await db + .prepare("UPDATE secret SET provider = 'file' WHERE id = 'sec_1' AND scope_id = 'scope_a'") + .run(); + await importLegacySecrets(db.client, "scope_a", rows); const provider = ( - db + await db .prepare("SELECT provider FROM secret WHERE id = ? AND scope_id = ?") - .get("sec_1", "scope_a") as { provider: string } - ).provider; + .get<{ provider: string }>("sec_1", "scope_a") + )?.provider; db.close(); expect(provider).toBe("file"); }); diff --git a/apps/local/src/server/db-upgrade.ts b/apps/local/src/server/db-upgrade.ts index 7457c7a9b..40ff1d66a 100644 --- a/apps/local/src/server/db-upgrade.ts +++ b/apps/local/src/server/db-upgrade.ts @@ -9,30 +9,37 @@ // backup; most never will — the rows are stale tool catalogs they'd // re-fetch anyway. -import { Database } from "bun:sqlite"; +import { type Client } from "@libsql/client"; import { randomBytes } from "node:crypto"; import * as fs from "node:fs"; +import { openLegacyLibsql, queryFirst, queryRows } from "./libsql"; + /** * Returns true when the DB at `dbPath` looks like it was written by a * pre-scope executor — has a `source` table but no `scope_id` column. * Fresh DBs (no `source` table yet) and current DBs both return false. + * + * Reads the legacy on-disk SQLite file through libSQL (same file format); + * readonly intent is enforced by issuing only SELECT/PRAGMA reads. */ -export const isPreScopeSchema = (dbPath: string): boolean => { +export const isPreScopeSchema = async (dbPath: string): Promise => { if (!fs.existsSync(dbPath)) return false; - const db = new Database(dbPath, { readonly: true }); + const client = openLegacyLibsql(dbPath); // oxlint-disable-next-line executor/no-try-catch-or-throw -- boundary: local SQLite schema probe must close the DB handle try { - const tableExists = db - .prepare("SELECT name FROM sqlite_master WHERE type='table' AND name='source'") - .get(); + const tableExists = await queryFirst( + client, + "SELECT name FROM sqlite_master WHERE type='table' AND name='source'", + ); if (!tableExists) return false; - const columns = db.prepare("PRAGMA table_info('source')").all() as ReadonlyArray<{ - readonly name: string; - }>; + const columns = await queryRows<{ readonly name: string }>( + client, + "PRAGMA table_info('source')", + ); return !columns.some((c) => c.name === "scope_id"); } finally { - db.close(); + client.close(); } }; @@ -41,8 +48,8 @@ export const isPreScopeSchema = (dbPath: string): boolean => { * `.pre-scopes-`. Returns the backup path if anything * was moved, otherwise null. */ -export const moveAsidePreScopeDb = (dbPath: string): string | null => { - if (!isPreScopeSchema(dbPath)) return null; +export const moveAsidePreScopeDb = async (dbPath: string): Promise => { + if (!(await isPreScopeSchema(dbPath))) return null; // Timestamp alone is near-unique; the random suffix makes it actually // unique even if two moves ever land in the same millisecond. const suffix = `${Date.now()}-${randomBytes(4).toString("hex")}`; @@ -71,20 +78,22 @@ export interface LegacySecret { readonly createdAt: number; } -export const readLegacySecrets = (dbPath: string): readonly LegacySecret[] => { +export const readLegacySecrets = async (dbPath: string): Promise => { if (!fs.existsSync(dbPath)) return []; - const db = new Database(dbPath, { readonly: true }); + const client = openLegacyLibsql(dbPath); // oxlint-disable-next-line executor/no-try-catch-or-throw -- boundary: local SQLite legacy-row read must close the DB handle try { - const tableExists = db - .prepare("SELECT name FROM sqlite_master WHERE type='table' AND name='secret'") - .get(); + const tableExists = await queryFirst( + client, + "SELECT name FROM sqlite_master WHERE type='table' AND name='secret'", + ); if (!tableExists) return []; - return db - .prepare("SELECT id, name, provider, created_at as createdAt FROM secret") - .all() as LegacySecret[]; + return await queryRows( + client, + "SELECT id, name, provider, created_at as createdAt FROM secret", + ); } finally { - db.close(); + client.close(); } }; @@ -93,16 +102,16 @@ export const readLegacySecrets = (dbPath: string): readonly LegacySecret[] => { * stamping the current scope id. Idempotent — uses INSERT OR IGNORE so * a row that the user already re-registered takes precedence. */ -export const importLegacySecrets = ( - db: Database, +export const importLegacySecrets = async ( + client: Client, scopeId: string, secrets: readonly LegacySecret[], -): void => { +): Promise => { if (secrets.length === 0) return; - const stmt = db.prepare( - "INSERT OR IGNORE INTO secret (scope_id, id, name, provider, created_at) VALUES (?, ?, ?, ?, ?)", - ); for (const s of secrets) { - stmt.run(scopeId, s.id, s.name, s.provider, s.createdAt); + await client.execute({ + sql: "INSERT OR IGNORE INTO secret (scope_id, id, name, provider, created_at) VALUES (?, ?, ?, ?, ?)", + args: [scopeId, s.id, s.name, s.provider, s.createdAt], + }); } }; diff --git a/apps/local/src/server/executor.ts b/apps/local/src/server/executor.ts index ec5a479c9..76e9fdd86 100644 --- a/apps/local/src/server/executor.ts +++ b/apps/local/src/server/executor.ts @@ -1,7 +1,7 @@ import { Context, Data, Effect, Layer, ManagedRuntime, Schema } from "effect"; -import { Database } from "bun:sqlite"; -import { drizzle } from "drizzle-orm/bun-sqlite"; -import { migrate } from "drizzle-orm/bun-sqlite/migrator"; +import { type Client } from "@libsql/client"; +import { drizzle } from "drizzle-orm/libsql"; +import { migrate } from "drizzle-orm/libsql/migrator"; import { createHash, randomBytes } from "node:crypto"; import * as fs from "node:fs"; import { homedir, tmpdir } from "node:os"; @@ -10,12 +10,12 @@ import { basename, dirname, join } from "node:path"; import { Scope, ScopeId, - collectTables, createExecutor, type AnyPlugin, type Executor, type FumaTables, } from "@executor-js/sdk"; +import { collectTables } from "@executor-js/api/server"; import { withQueryContext } from "fumadb/query"; import { loadPluginsFromJsonc } from "@executor-js/config"; @@ -34,6 +34,7 @@ import { type LocalSqliteImportResult, } from "./sqlite-import"; import { createSqliteFumaDb } from "./sqlite-fumadb"; +import { openLegacyLibsql, queryFirst, queryRows } from "./libsql"; import { oneShotMigrateGoogleDiscoveryToOpenApi } from "./google-discovery-openapi-migration"; interface ResolvedStorage { @@ -182,29 +183,39 @@ const handleOrNull = (promise: ReturnType) => ), ); -const sqliteTableHasColumn = (db: Database, table: string, column: string): boolean => - db - .query<{ name: string }, []>(`PRAGMA table_info('${table.replaceAll("'", "''")}')`) - .all() - .some((row) => row.name === column); +const sqliteTableHasColumn = async ( + client: Client, + table: string, + column: string, +): Promise => { + const rows = await queryRows<{ name: string }>( + client, + `PRAGMA table_info('${table.replaceAll("'", "''")}')`, + ); + return rows.some((row) => row.name === column); +}; -export const drizzleMigrationsTableExists = (sqlite: Database): boolean => { - const row = sqlite - .query<{ name: string }, [string]>( - "SELECT name FROM sqlite_master WHERE type = 'table' AND name = ?", - ) - .get("__drizzle_migrations"); +export const drizzleMigrationsTableExists = async (client: Client): Promise => { + const row = await queryFirst( + client, + "SELECT name FROM sqlite_master WHERE type = 'table' AND name = ?", + ["__drizzle_migrations"], + ); return row != null; }; -export const readAppliedDrizzleMigrationHashes = (sqlite: Database): ReadonlyArray => { - if (!drizzleMigrationsTableExists(sqlite)) return []; +export const readAppliedDrizzleMigrationHashes = async ( + client: Client, +): Promise> => { + if (!(await drizzleMigrationsTableExists(client))) return []; - return sqlite - .query<{ hash: string }, []>("SELECT hash FROM __drizzle_migrations ORDER BY id ASC") - .all() - .map((row) => row.hash); + return ( + await queryRows<{ hash: string }>( + client, + "SELECT hash FROM __drizzle_migrations ORDER BY id ASC", + ) + ).map((row) => row.hash); }; const DrizzleJournal = Schema.Struct({ @@ -233,36 +244,36 @@ export const readBundledDrizzleMigrationHashes = ( }); }; -const hasBundledDrizzleMigrationPrefix = (input: { - readonly sqlite: Database; +const hasBundledDrizzleMigrationPrefix = async (input: { + readonly client: Client; readonly migrationsFolder: string; -}): boolean => { - if (!drizzleMigrationsTableExists(input.sqlite)) return true; +}): Promise => { + if (!(await drizzleMigrationsTableExists(input.client))) return true; - const applied = readAppliedDrizzleMigrationHashes(input.sqlite); + const applied = await readAppliedDrizzleMigrationHashes(input.client); const bundled = readBundledDrizzleMigrationHashes(input.migrationsFolder); return ( applied.length <= bundled.length && applied.every((hash, index) => hash === bundled[index]) ); }; -const isFumaSqliteDatabase = (path: string): boolean => { +const isFumaSqliteDatabase = async (path: string): Promise => { if (!fs.existsSync(path)) return false; - let db: Database | null = null; + let client: Client | null = null; // oxlint-disable-next-line executor/no-try-catch-or-throw -- boundary: native SQLite probe treats unreadable legacy files as non-FumaDB databases try { - db = new Database(path, { readonly: true }); - const settings = db - .query<{ name: string }, [string]>( - "SELECT name FROM sqlite_master WHERE type = 'table' AND name = ?", - ) - .get(`private_${localNamespace}_settings`); - return settings !== null || sqliteTableHasColumn(db, "source", "row_id"); + client = openLegacyLibsql(path); + const settings = await queryFirst( + client, + "SELECT name FROM sqlite_master WHERE type = 'table' AND name = ?", + [`private_${localNamespace}_settings`], + ); + return settings != null || (await sqliteTableHasColumn(client, "source", "row_id")); } catch { return false; } finally { - db?.close(); + client?.close(); } }; @@ -293,24 +304,23 @@ const moveSqliteFileSetToBackup = (path: string): string => { return backupPath; }; -const checkpointSqliteForFileMove = (input: { - readonly sqlite: Database; +const checkpointSqliteForFileMove = async (input: { + readonly client: Client; readonly path: string; -}) => { - const checkpoint = input.sqlite - .query<{ busy: number; log: number; checkpointed: number }, []>( - "PRAGMA wal_checkpoint(TRUNCATE)", - ) - .get(); +}): Promise => { + const checkpoint = await queryFirst<{ busy: number; log: number; checkpointed: number }>( + input.client, + "PRAGMA wal_checkpoint(TRUNCATE)", + ); if (checkpoint && checkpoint.busy !== 0) { - // oxlint-disable-next-line executor/no-try-catch-or-throw -- boundary: SQLite file replacement is synchronous; callers wrap this native failure into LocalExecutorCreateError + // oxlint-disable-next-line executor/no-try-catch-or-throw -- boundary: callers wrap this checkpoint-busy failure into LocalExecutorCreateError before a file move throw new LocalSqliteCheckpointError({ path: input.path, busy: checkpoint.busy }); } // oxlint-disable-next-line executor/no-try-catch-or-throw -- boundary: DELETE mode is best-effort after a successful checkpoint; an open read handle can reject the mode switch without making the file set unsafe to move try { - input.sqlite.exec("PRAGMA journal_mode = DELETE"); + await input.client.execute("PRAGMA journal_mode = DELETE"); } catch (cause) { console.warn( `[executor] Checkpointed SQLite WAL for ${input.path}, but could not switch journal mode to DELETE before import. Continuing with the checkpointed file set.`, @@ -417,16 +427,19 @@ interface PreparedLegacySqlite { readonly preScopeBackup?: string; } -const prepareLegacySqliteForFumaImport = (input: { +const prepareLegacySqliteForFumaImport = async (input: { readonly storage: ResolvedStorage; readonly scopeId: string; -}): PreparedLegacySqlite => { - if (!fs.existsSync(input.storage.sqlitePath) || isFumaSqliteDatabase(input.storage.sqlitePath)) { +}): Promise => { + if ( + !fs.existsSync(input.storage.sqlitePath) || + (await isFumaSqliteDatabase(input.storage.sqlitePath)) + ) { return { legacySecrets: [] }; } - const legacySecrets = readLegacySecrets(input.storage.sqlitePath); - const preScopeBackup = moveAsidePreScopeDb(input.storage.sqlitePath); + const legacySecrets = await readLegacySecrets(input.storage.sqlitePath); + const preScopeBackup = await moveAsidePreScopeDb(input.storage.sqlitePath); if (preScopeBackup) { console.warn( `[executor] Pre-scope database detected; moved to ${preScopeBackup}. ` + @@ -438,15 +451,15 @@ const prepareLegacySqliteForFumaImport = (input: { return { legacySecrets, preScopeBackup }; } - const sqlite = new Database(input.storage.sqlitePath); + const client = openLegacyLibsql(input.storage.sqlitePath); // oxlint-disable-next-line executor/no-try-catch-or-throw -- boundary: legacy migration preflight must close SQLite before the FumaDB import re-opens the file try { - if (hasBundledDrizzleMigrationPrefix({ sqlite, migrationsFolder: MIGRATIONS_FOLDER })) { - sqlite.exec("PRAGMA journal_mode = WAL"); - migrate(drizzle(sqlite, { schema: legacyExecutorSchema }), { + if (await hasBundledDrizzleMigrationPrefix({ client, migrationsFolder: MIGRATIONS_FOLDER })) { + await client.execute("PRAGMA journal_mode = WAL"); + await migrate(drizzle({ client, schema: legacyExecutorSchema }), { migrationsFolder: MIGRATIONS_FOLDER, }); - importLegacySecrets(sqlite, input.scopeId, legacySecrets); + await importLegacySecrets(client, input.scopeId, legacySecrets); } else { console.warn( `[executor] Local SQLite migration history in ${input.storage.dataDir} ` + @@ -454,10 +467,10 @@ const prepareLegacySqliteForFumaImport = (input: { `Skipping legacy Drizzle replay and importing the existing schema as-is.`, ); } - checkpointSqliteForFileMove({ sqlite, path: input.storage.sqlitePath }); + await checkpointSqliteForFileMove({ client, path: input.storage.sqlitePath }); return { legacySecrets: [] }; } finally { - sqlite.close(); + client.close(); } }; @@ -487,7 +500,7 @@ const importMissingMarkedTables = async (input: { // oxlint-disable-next-line executor/no-try-catch-or-throw -- boundary: late plugin-table imports must close the active SQLite handle on failure try { const pickedTables = pickFumaTables(input.tables, missingTableSet); - const legacyScopeIds = readLegacySqliteScopeIds({ + const legacyScopeIds = await readLegacySqliteScopeIds({ sqlitePath: input.marker.backupPath, tables: pickedTables, scopeId: input.scopeId, @@ -500,7 +513,7 @@ const importMissingMarkedTables = async (input: { tables: pickedTables, scopeId: input.scopeId, }); - checkpointSqliteForFileMove({ sqlite: target.sqlite, path: input.storage.sqlitePath }); + await checkpointSqliteForFileMove({ client: target.client, path: input.storage.sqlitePath }); await target.close(); removeSqliteSidecars(input.storage.sqlitePath); @@ -544,14 +557,14 @@ export const importLegacySqliteIfNeeded = async (options: { } if (!fs.existsSync(storage.importMarkerPath) && fs.existsSync(storage.sqlitePath)) { - if (isFumaSqliteDatabase(storage.sqlitePath)) { + if (await isFumaSqliteDatabase(storage.sqlitePath)) { writeSqliteImportMarker(storage.importMarkerPath, { importedRows: 0, importedTables: [], recovered: true, }); } else { - const prepared = prepareLegacySqliteForFumaImport({ storage, scopeId }); + const prepared = await prepareLegacySqliteForFumaImport({ storage, scopeId }); if (prepared.preScopeBackup) { if (prepared.legacySecrets.length > 0) { const target = await createSqliteFumaDb({ @@ -564,7 +577,7 @@ export const importLegacySqliteIfNeeded = async (options: { await withQueryContext(target.db, { allowedScopeIds: new Set([scopeId]), }).createMany("secret", createLegacySecretRows(scopeId, prepared.legacySecrets)); - checkpointSqliteForFileMove({ sqlite: target.sqlite, path: storage.sqlitePath }); + await checkpointSqliteForFileMove({ client: target.client, path: storage.sqlitePath }); } finally { await target.close(); removeSqliteSidecars(storage.sqlitePath); @@ -589,7 +602,7 @@ export const importLegacySqliteIfNeeded = async (options: { !fs.existsSync(storage.importMarkerPath) && !fs.existsSync(storage.sqlitePath) && fs.existsSync(targetPath) && - isFumaSqliteDatabase(targetPath) + (await isFumaSqliteDatabase(targetPath)) ) { moveSqliteFileSet(targetPath, storage.sqlitePath); writeSqliteImportMarker(storage.importMarkerPath, { @@ -602,7 +615,7 @@ export const importLegacySqliteIfNeeded = async (options: { if ( !fs.existsSync(storage.sqlitePath) || fs.existsSync(storage.importMarkerPath) || - isFumaSqliteDatabase(storage.sqlitePath) + (await isFumaSqliteDatabase(storage.sqlitePath)) ) { return { imported: false, importedRows: 0, importedTables: [] }; } @@ -617,7 +630,7 @@ export const importLegacySqliteIfNeeded = async (options: { // oxlint-disable-next-line executor/no-try-catch-or-throw -- boundary: local SQLite cutover must close and remove the temporary target database on import failure try { - const legacyScopeIds = readLegacySqliteScopeIds({ + const legacyScopeIds = await readLegacySqliteScopeIds({ sqlitePath: storage.sqlitePath, tables, scopeId, @@ -630,7 +643,7 @@ export const importLegacySqliteIfNeeded = async (options: { tables, scopeId, }); - checkpointSqliteForFileMove({ sqlite: target.sqlite, path: targetPath }); + await checkpointSqliteForFileMove({ client: target.client, path: targetPath }); await target.close(); removeSqliteSidecars(targetPath); @@ -689,7 +702,9 @@ const createLocalExecutorLayer = () => { (db) => Effect.promise(() => db.close()).pipe(Effect.ignore), ); - const migratedGoogleDiscoverySources = oneShotMigrateGoogleDiscoveryToOpenApi(sqlite.sqlite); + const migratedGoogleDiscoverySources = yield* Effect.promise(() => + oneShotMigrateGoogleDiscoveryToOpenApi(sqlite.client), + ); if (importResult.imported) { console.warn( diff --git a/apps/local/src/server/google-discovery-openapi-migration.test.ts b/apps/local/src/server/google-discovery-openapi-migration.test.ts index c6c547fd0..b66612e96 100644 --- a/apps/local/src/server/google-discovery-openapi-migration.test.ts +++ b/apps/local/src/server/google-discovery-openapi-migration.test.ts @@ -1,6 +1,9 @@ -import { describe, expect, it } from "@effect/vitest"; -import { Database } from "bun:sqlite"; +import { afterEach, beforeEach, describe, expect, it } from "@effect/vitest"; +import { createClient, type Client } from "@libsql/client"; import { Schema } from "effect"; +import { mkdtempSync, rmSync } from "node:fs"; +import { tmpdir } from "node:os"; +import { join } from "node:path"; import { oneShotMigrateGoogleDiscoveryToOpenApi } from "./google-discovery-openapi-migration"; @@ -24,9 +27,23 @@ const decodeMigratedSourceData = Schema.decodeUnknownSync( ); const decodeMigratedSpec = Schema.decodeUnknownSync(Schema.fromJsonString(MigratedSpec)); -const createMigrationFixture = () => { - const db = new Database(":memory:"); - db.exec(` +// libSQL's `:memory:` opens a SEPARATE in-memory database per connection, so a +// write transaction (used by the one-shot migration) would not see the seeded +// tables. Back the fixture with a temp file so the migration's transaction +// shares the same database — matching local's real on-disk usage. +let fixtureDir: string; + +beforeEach(() => { + fixtureDir = mkdtempSync(join(tmpdir(), "gd-openapi-mig-")); +}); + +afterEach(() => { + rmSync(fixtureDir, { recursive: true, force: true }); +}); + +const createMigrationFixture = async (): Promise => { + const db = createClient({ url: `file:${join(fixtureDir, "data.db")}` }); + await db.executeMultiple(` CREATE TABLE google_discovery_source ( id text NOT NULL, scope_id text NOT NULL, @@ -133,131 +150,148 @@ const createMigrationFixture = () => { }; describe("oneShotMigrateGoogleDiscoveryToOpenApi", () => { - it("moves a Google Discovery source into OpenAPI storage without changing tool ids", () => { - const db = createMigrationFixture(); + it("moves a Google Discovery source into OpenAPI storage without changing tool ids", async () => { + const db = await createMigrationFixture(); const now = 1_700_000_000; const sourceId = "gmail_api"; const scopeId = "local-scope"; const toolId = `${sourceId}.users.messages.list`; - db.prepare( - "INSERT INTO google_discovery_source (id, scope_id, name, config, auth_kind, auth_connection_id, auth_client_id_secret_id, auth_client_secret_secret_id, auth_scopes, created_at, updated_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)", - ).run( - sourceId, - scopeId, - "Gmail API", - encodeJson({ - discoveryUrl: "https://www.googleapis.com/discovery/v1/apis/gmail/v1/rest", - service: "gmail", - version: "v1", - rootUrl: "https://gmail.googleapis.com/", - servicePath: "", - }), - "oauth2", - "google-discovery-oauth2-gmail_api", - "client-id-secret", - "client-secret-secret", - encodeJson(["https://www.googleapis.com/auth/gmail.metadata"]), - now, - now, - ); - db.prepare( - "INSERT INTO source (id, scope_id, plugin_id, kind, name, url, can_remove, can_refresh, can_edit, created_at, updated_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)", - ).run( - sourceId, - scopeId, - "googleDiscovery", - "googleDiscovery", - "Gmail API", - null, - 1, - 0, - 1, - now, - now, - ); - db.prepare( - "INSERT INTO google_discovery_binding (id, scope_id, source_id, binding, created_at) VALUES (?, ?, ?, ?, ?)", - ).run( - toolId, - scopeId, - sourceId, - encodeJson({ - method: "get", - pathTemplate: "gmail/v1/users/{userId}/messages", - hasBody: false, - parameters: [ - { - name: "userId", - location: "path", - required: true, - repeated: false, - schema: { type: "string" }, - }, - { - name: "metadataHeaders", - location: "query", - required: false, - repeated: true, - schema: { type: "array", items: { type: "string" } }, + await db.execute({ + sql: "INSERT INTO google_discovery_source (id, scope_id, name, config, auth_kind, auth_connection_id, auth_client_id_secret_id, auth_client_secret_secret_id, auth_scopes, created_at, updated_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)", + args: [ + sourceId, + scopeId, + "Gmail API", + encodeJson({ + discoveryUrl: "https://www.googleapis.com/discovery/v1/apis/gmail/v1/rest", + service: "gmail", + version: "v1", + rootUrl: "https://gmail.googleapis.com/", + servicePath: "", + }), + "oauth2", + "google-discovery-oauth2-gmail_api", + "client-id-secret", + "client-secret-secret", + encodeJson(["https://www.googleapis.com/auth/gmail.metadata"]), + now, + now, + ], + }); + await db.execute({ + sql: "INSERT INTO source (id, scope_id, plugin_id, kind, name, url, can_remove, can_refresh, can_edit, created_at, updated_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)", + args: [ + sourceId, + scopeId, + "googleDiscovery", + "googleDiscovery", + "Gmail API", + null, + 1, + 0, + 1, + now, + now, + ], + }); + await db.execute({ + sql: "INSERT INTO google_discovery_binding (id, scope_id, source_id, binding, created_at) VALUES (?, ?, ?, ?, ?)", + args: [ + toolId, + scopeId, + sourceId, + encodeJson({ + method: "get", + pathTemplate: "gmail/v1/users/{userId}/messages", + hasBody: false, + parameters: [ + { + name: "userId", + location: "path", + required: true, + repeated: false, + schema: { type: "string" }, + }, + { + name: "metadataHeaders", + location: "query", + required: false, + repeated: true, + schema: { type: "array", items: { type: "string" } }, + }, + ], + }), + now, + ], + }); + await db.execute({ + sql: "INSERT INTO tool (id, scope_id, source_id, plugin_id, name, description, input_schema, output_schema, created_at, updated_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)", + args: [ + toolId, + scopeId, + sourceId, + "googleDiscovery", + "users.messages.list", + "Lists messages.", + encodeJson({ + type: "object", + properties: { + userId: { type: "string" }, + metadataHeaders: { type: "array", items: { type: "string" } }, }, - ], - }), - now, - ); - db.prepare( - "INSERT INTO tool (id, scope_id, source_id, plugin_id, name, description, input_schema, output_schema, created_at, updated_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)", - ).run( - toolId, - scopeId, - sourceId, - "googleDiscovery", - "users.messages.list", - "Lists messages.", - encodeJson({ - type: "object", - properties: { - userId: { type: "string" }, - metadataHeaders: { type: "array", items: { type: "string" } }, - }, - }), - encodeJson({ $ref: "#/$defs/ListMessagesResponse" }), - now, - now, - ); - db.prepare( - "INSERT INTO definition (id, scope_id, source_id, plugin_id, name, schema, created_at) VALUES (?, ?, ?, ?, ?, ?, ?)", - ).run( - `${sourceId}.ListMessagesResponse`, - scopeId, - sourceId, - "googleDiscovery", - "ListMessagesResponse", - encodeJson({ type: "object", properties: { messages: { type: "array" } } }), - now, - ); + }), + encodeJson({ $ref: "#/$defs/ListMessagesResponse" }), + now, + now, + ], + }); + await db.execute({ + sql: "INSERT INTO definition (id, scope_id, source_id, plugin_id, name, schema, created_at) VALUES (?, ?, ?, ?, ?, ?, ?)", + args: [ + `${sourceId}.ListMessagesResponse`, + scopeId, + sourceId, + "googleDiscovery", + "ListMessagesResponse", + encodeJson({ type: "object", properties: { messages: { type: "array" } } }), + now, + ], + }); - const migrated = oneShotMigrateGoogleDiscoveryToOpenApi(db); + const migrated = await oneShotMigrateGoogleDiscoveryToOpenApi(db); expect(migrated).toBe(1); expect( - db.prepare("SELECT count(*) AS n FROM google_discovery_source").get() as { n: number }, + (await db.execute("SELECT count(*) AS n FROM google_discovery_source")).rows[0], ).toMatchObject({ n: 0 }); expect( - db.prepare("SELECT plugin_id, kind, url, can_refresh FROM source WHERE id = ?").get(sourceId), + ( + await db.execute({ + sql: "SELECT plugin_id, kind, url, can_refresh FROM source WHERE id = ?", + args: [sourceId], + }) + ).rows[0], ).toMatchObject({ plugin_id: "openapi", kind: "openapi", url: "https://gmail.googleapis.com/", can_refresh: 0, }); - expect(db.prepare("SELECT plugin_id FROM tool WHERE id = ?").get(toolId)).toMatchObject({ + expect( + (await db.execute({ sql: "SELECT plugin_id FROM tool WHERE id = ?", args: [toolId] })) + .rows[0], + ).toMatchObject({ plugin_id: "openapi", }); - const sourceStorage = db - .prepare("SELECT data FROM plugin_storage WHERE collection = 'source' AND key = ?") - .get(sourceId) as { data: string }; + // oxlint-disable-next-line executor/no-double-cast -- boundary: the SELECT column is the schema contract for this plugin_storage row read off the libSQL client + const sourceStorage = ( + await db.execute({ + sql: "SELECT data FROM plugin_storage WHERE collection = 'source' AND key = ?", + args: [sourceId], + }) + ).rows[0] as unknown as { data: string }; const sourceData = decodeMigratedSourceData(sourceStorage.data); const spec = decodeMigratedSpec(sourceData.config.spec); const operation = spec.paths["/gmail/v1/users/{userId}/messages"]?.get; @@ -278,13 +312,18 @@ describe("oneShotMigrateGoogleDiscoveryToOpenApi", () => { }); expect( - db.prepare("SELECT key FROM plugin_storage WHERE collection = 'operation'").get(), + (await db.execute("SELECT key FROM plugin_storage WHERE collection = 'operation'")).rows[0], ).toMatchObject({ key: toolId }); - const credentialBindings = db - .prepare( + const credentialBindings = ( + await db.execute( "SELECT slot_key, kind, secret_id, connection_id FROM credential_binding ORDER BY slot_key", ) - .all(); + ).rows.map((row) => ({ + slot_key: row.slot_key, + kind: row.kind, + secret_id: row.secret_id, + connection_id: row.connection_id, + })); expect(credentialBindings).toEqual([ { slot_key: "oauth2:googleoauth2:client-id", diff --git a/apps/local/src/server/google-discovery-openapi-migration.ts b/apps/local/src/server/google-discovery-openapi-migration.ts index 19424647c..1109a574c 100644 --- a/apps/local/src/server/google-discovery-openapi-migration.ts +++ b/apps/local/src/server/google-discovery-openapi-migration.ts @@ -1,7 +1,9 @@ -import { Database } from "bun:sqlite"; +import { type Client, type InValue } from "@libsql/client"; import { Option, Schema } from "effect"; import { randomBytes } from "node:crypto"; +import { queryFirst, queryRows } from "./libsql"; + const UnknownRecord = Schema.Record(Schema.String, Schema.Unknown); const GoogleDiscoveryConfig = Schema.Struct({ @@ -117,17 +119,22 @@ type OpenApiParameter = { const textDecoder = new TextDecoder(); +// libSQL returns BLOB columns as ArrayBuffer (legacy rows stored JSON as bytes), +// TEXT columns as string. Normalize both to text before JSON-decoding. const decodeJsonColumnOption = ( decode: (value: unknown) => Option.Option, - value: string | Uint8Array | null | undefined, + value: string | Uint8Array | ArrayBuffer | null | undefined, ): Option.Option => { if (!value) return Option.none(); - const text = typeof value === "string" ? value : textDecoder.decode(value); + const text = + typeof value === "string" + ? value + : textDecoder.decode(value instanceof ArrayBuffer ? new Uint8Array(value) : value); return decode(text); }; const decodeJsonColumnOrUndefined = ( - value: string | Uint8Array | null | undefined, + value: string | Uint8Array | ArrayBuffer | null | undefined, ): unknown | undefined => Option.getOrUndefined(decodeJsonColumnOption(decodeUnknownJson, value)); const recordFromUnknown = (value: unknown): Record => @@ -229,19 +236,24 @@ const openApiParameters = ( ...(parameter.description ? { description: parameter.description } : {}), })); -export const oneShotMigrateGoogleDiscoveryToOpenApi = (sqlite: Database): number => { - const table = sqlite - .query<{ name: string }, [string]>( - "SELECT name FROM sqlite_master WHERE type = 'table' AND name = ?", - ) - .get("google_discovery_source"); +// One-shot startup migration over the LIVE libSQL handle (same file the app +// runs on). Each source migrates inside its own write transaction so a failure +// leaves that source atomic; reads and the BEGIN/COMMIT/ROLLBACK block move from +// synchronous bun:sqlite to async `client.execute` / `client.transaction`. +export const oneShotMigrateGoogleDiscoveryToOpenApi = async (client: Client): Promise => { + const table = await queryFirst( + client, + "SELECT name FROM sqlite_master WHERE type = 'table' AND name = ?", + ["google_discovery_source"], + ); if (!table) return 0; - const sources = sqlite - .query("SELECT * FROM google_discovery_source ORDER BY scope_id, id") - .all(); + const sources = await queryRows( + client, + "SELECT * FROM google_discovery_source ORDER BY scope_id, id", + ); let migrated = 0; - const migrateSource = (source: GoogleSourceRow): boolean => { + const migrateSource = async (source: GoogleSourceRow): Promise => { const config = readSourceConfig(source); if (!config) return false; @@ -250,26 +262,27 @@ export const oneShotMigrateGoogleDiscoveryToOpenApi = (sqlite: Database): number const version = nonEmptyStringOrUndefined(config.version) ?? "v1"; const discoveryUrl = nonEmptyStringOrUndefined(config.discoveryUrl); - const bindings = sqlite - .query( - "SELECT * FROM google_discovery_binding WHERE scope_id = ? AND source_id = ? ORDER BY id", - ) - .all(source.scope_id, source.id); + const bindings = await queryRows( + client, + "SELECT * FROM google_discovery_binding WHERE scope_id = ? AND source_id = ? ORDER BY id", + [source.scope_id, source.id], + ); if (bindings.length === 0) return false; const toolRows = new Map( - sqlite - .query( + ( + await queryRows( + client, "SELECT id, name, description, input_schema, output_schema FROM tool WHERE scope_id = ? AND source_id = ?", + [source.scope_id, source.id], ) - .all(source.scope_id, source.id) - .map((row) => [row.id, row] as const), + ).map((row) => [row.id, row] as const), + ); + const definitions = await queryRows( + client, + "SELECT name, schema FROM definition WHERE scope_id = ? AND source_id = ? ORDER BY name", + [source.scope_id, source.id], ); - const definitions = sqlite - .query( - "SELECT name, schema FROM definition WHERE scope_id = ? AND source_id = ? ORDER BY name", - ) - .all(source.scope_id, source.id); const paths: Record> = {}; const operationRows: Array<{ readonly toolId: string; readonly binding: unknown }> = []; @@ -410,16 +423,16 @@ export const oneShotMigrateGoogleDiscoveryToOpenApi = (sqlite: Database): number const credentialBindings: MigratedCredentialBinding[] = []; - const headerRows = sqlite - .query( - "SELECT name, kind, text_value, secret_id, secret_prefix FROM google_discovery_source_credential_header WHERE scope_id = ? AND source_id = ?", - ) - .all(source.scope_id, source.id); - const queryParamRows = sqlite - .query( - "SELECT name, kind, text_value, secret_id, secret_prefix FROM google_discovery_source_credential_query_param WHERE scope_id = ? AND source_id = ?", - ) - .all(source.scope_id, source.id); + const headerRows = await queryRows( + client, + "SELECT name, kind, text_value, secret_id, secret_prefix FROM google_discovery_source_credential_header WHERE scope_id = ? AND source_id = ?", + [source.scope_id, source.id], + ); + const queryParamRows = await queryRows( + client, + "SELECT name, kind, text_value, secret_id, secret_prefix FROM google_discovery_source_credential_query_param WHERE scope_id = ? AND source_id = ?", + [source.scope_id, source.id], + ); const headers = googleCredentialMap(headerRows, openApiHeaderSlot, credentialBindings); const queryParams = googleCredentialMap( queryParamRows, @@ -464,14 +477,14 @@ export const oneShotMigrateGoogleDiscoveryToOpenApi = (sqlite: Database): number }, }; - sqlite.exec("BEGIN IMMEDIATE"); + // Each source migrates atomically: a libSQL write transaction replaces the + // bun:sqlite BEGIN IMMEDIATE / COMMIT / ROLLBACK block. + const tx = await client.transaction("write"); // oxlint-disable-next-line executor/no-try-catch-or-throw -- boundary: one-shot startup migration should leave each source atomic on write failure try { - sqlite - .query( - "INSERT OR REPLACE INTO plugin_storage (plugin_id, collection, key, data, created_at, updated_at, row_id, id, scope_id) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)", - ) - .run( + await tx.execute({ + sql: "INSERT OR REPLACE INTO plugin_storage (plugin_id, collection, key, data, created_at, updated_at, row_id, id, scope_id) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)", + args: [ "openapi", "source", source.id, @@ -481,14 +494,13 @@ export const oneShotMigrateGoogleDiscoveryToOpenApi = (sqlite: Database): number randomRowId(), openApiPluginStorageId("source", source.id), source.scope_id, - ); + ] satisfies InValue[], + }); for (const operation of operationRows) { - sqlite - .query( - "INSERT OR REPLACE INTO plugin_storage (plugin_id, collection, key, data, created_at, updated_at, row_id, id, scope_id) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)", - ) - .run( + await tx.execute({ + sql: "INSERT OR REPLACE INTO plugin_storage (plugin_id, collection, key, data, created_at, updated_at, row_id, id, scope_id) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)", + args: [ "openapi", "operation", operation.toolId, @@ -502,18 +514,17 @@ export const oneShotMigrateGoogleDiscoveryToOpenApi = (sqlite: Database): number randomRowId(), openApiPluginStorageId("operation", operation.toolId), source.scope_id, - ); + ] satisfies InValue[], + }); } for (const binding of credentialBindings) { const secretId = binding.kind === "secret" ? binding.secretId : null; const secretScopeId = binding.kind === "secret" ? source.scope_id : null; const connectionId = binding.kind === "connection" ? binding.connectionId : null; - sqlite - .query( - "INSERT OR REPLACE INTO credential_binding (plugin_id, source_id, source_scope_id, slot_key, kind, text_value, secret_id, secret_scope_id, connection_id, created_at, updated_at, row_id, id, scope_id) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)", - ) - .run( + await tx.execute({ + sql: "INSERT OR REPLACE INTO credential_binding (plugin_id, source_id, source_scope_id, slot_key, kind, text_value, secret_id, secret_scope_id, connection_id, created_at, updated_at, row_id, id, scope_id) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)", + args: [ "openapi", source.id, source.scope_id, @@ -528,40 +539,42 @@ export const oneShotMigrateGoogleDiscoveryToOpenApi = (sqlite: Database): number randomRowId(), openApiCredentialBindingId(source.scope_id, source.id, binding.slot), source.scope_id, - ); + ] satisfies InValue[], + }); } - sqlite - .query( - "UPDATE source SET plugin_id = ?, kind = ?, url = ?, can_refresh = ?, can_edit = ?, updated_at = ? WHERE scope_id = ? AND id = ?", - ) - .run("openapi", "openapi", baseUrl, 0, 1, now, source.scope_id, source.id); - sqlite - .query("UPDATE tool SET plugin_id = ?, updated_at = ? WHERE scope_id = ? AND source_id = ?") - .run("openapi", now, source.scope_id, source.id); - sqlite - .query("UPDATE definition SET plugin_id = ? WHERE scope_id = ? AND source_id = ?") - .run("openapi", source.scope_id, source.id); - sqlite - .query("DELETE FROM google_discovery_binding WHERE scope_id = ? AND source_id = ?") - .run(source.scope_id, source.id); - sqlite - .query( - "DELETE FROM google_discovery_source_credential_header WHERE scope_id = ? AND source_id = ?", - ) - .run(source.scope_id, source.id); - sqlite - .query( - "DELETE FROM google_discovery_source_credential_query_param WHERE scope_id = ? AND source_id = ?", - ) - .run(source.scope_id, source.id); - sqlite - .query("DELETE FROM google_discovery_source WHERE scope_id = ? AND id = ?") - .run(source.scope_id, source.id); - sqlite.exec("COMMIT"); + await tx.execute({ + sql: "UPDATE source SET plugin_id = ?, kind = ?, url = ?, can_refresh = ?, can_edit = ?, updated_at = ? WHERE scope_id = ? AND id = ?", + args: ["openapi", "openapi", baseUrl, 0, 1, now, source.scope_id, source.id], + }); + await tx.execute({ + sql: "UPDATE tool SET plugin_id = ?, updated_at = ? WHERE scope_id = ? AND source_id = ?", + args: ["openapi", now, source.scope_id, source.id], + }); + await tx.execute({ + sql: "UPDATE definition SET plugin_id = ? WHERE scope_id = ? AND source_id = ?", + args: ["openapi", source.scope_id, source.id], + }); + await tx.execute({ + sql: "DELETE FROM google_discovery_binding WHERE scope_id = ? AND source_id = ?", + args: [source.scope_id, source.id], + }); + await tx.execute({ + sql: "DELETE FROM google_discovery_source_credential_header WHERE scope_id = ? AND source_id = ?", + args: [source.scope_id, source.id], + }); + await tx.execute({ + sql: "DELETE FROM google_discovery_source_credential_query_param WHERE scope_id = ? AND source_id = ?", + args: [source.scope_id, source.id], + }); + await tx.execute({ + sql: "DELETE FROM google_discovery_source WHERE scope_id = ? AND id = ?", + args: [source.scope_id, source.id], + }); + await tx.commit(); } catch (cause) { - sqlite.exec("ROLLBACK"); - // oxlint-disable-next-line executor/no-try-catch-or-throw -- boundary: synchronous SQLite migration rolls back then preserves the original startup failure + await tx.rollback(); + // oxlint-disable-next-line executor/no-try-catch-or-throw -- boundary: the migration rolls back then preserves the original startup failure throw cause; } @@ -569,13 +582,13 @@ export const oneShotMigrateGoogleDiscoveryToOpenApi = (sqlite: Database): number }; for (const source of sources) { - if (migrateSource(source)) { + if (await migrateSource(source)) { migrated++; } } if (migrated > 0) { - sqlite.exec("PRAGMA wal_checkpoint(TRUNCATE)"); + await client.execute("PRAGMA wal_checkpoint(TRUNCATE)"); } return migrated; }; diff --git a/apps/local/src/server/identity.ts b/apps/local/src/server/identity.ts new file mode 100644 index 000000000..6944d23d0 --- /dev/null +++ b/apps/local/src/server/identity.ts @@ -0,0 +1,50 @@ +import { Effect, Layer } from "effect"; + +import { IdentityProvider, type Principal } from "@executor-js/api/server"; + +// --------------------------------------------------------------------------- +// The local identity seam — the production implementation of the shared +// `IdentityProvider` from `@executor-js/api/server` for the single-user local +// daemon. +// +// Local is single-user: there is no account/org directory, and the executor it +// serves is a single boot-built instance scoped to the working directory (see +// `FixedExecutionProvider` in `app.ts`). So this provider ALWAYS resolves the +// one local Principal — there is no credential lookup to perform here. (The +// optional process-level Basic/Bearer gate that protects a network bind lives in +// the Bun serve shell, `serve.ts`; it is a coarse network gate, not request +// identity, and stays separate.) +// +// This is a genuine implementation, not a placeholder: `authenticate` returns a +// concrete, stable `Principal` whose `AuthContext` the executor API handlers +// read. The fixed executor ignores the `accountId`/`organizationId` (it does NOT +// rebuild a per-(user, org) scope the way cloud/self-host do), so these values +// only populate `AuthContext` for handlers/telemetry that surface "who am I". +// --------------------------------------------------------------------------- + +/** + * The single local Principal every request resolves to. Stable across the + * process; the `local` ids identify the single-user daemon in `AuthContext` and + * any "me"-style surfaces. The fixed executor's scope is cwd-derived (in + * `app.ts`), independent of these ids. + */ +export const LOCAL_PRINCIPAL: Principal = { + accountId: "local", + organizationId: "local", + organizationName: "Local", + email: "", + name: null, + avatarUrl: null, + roles: [], +}; + +/** + * The local `IdentityProvider`: always resolves `LOCAL_PRINCIPAL`. A complete + * `Layer` with no residual requirement (`RIdentity = never`), + * so the facade captures it once at boot like self-host's. + */ +export const localIdentityLayer: Layer.Layer = Layer.succeed(IdentityProvider)( + IdentityProvider.of({ + authenticate: () => Effect.succeed(LOCAL_PRINCIPAL), + }), +); diff --git a/apps/local/src/server/libsql.ts b/apps/local/src/server/libsql.ts new file mode 100644 index 000000000..2eae6823d --- /dev/null +++ b/apps/local/src/server/libsql.ts @@ -0,0 +1,72 @@ +import { createClient, type Client, type InArgs, type ResultSet } from "@libsql/client"; +import { resolve } from "node:path"; + +// --------------------------------------------------------------------------- +// libSQL connection helpers for the local server. The local CLI/daemon used to +// open a single in-process bun:sqlite handle that drizzle and the legacy +// importers shared; libSQL instead opens a connection per `createClient`, so +// the per-connection PRAGMAs (foreign_keys, WAL) must be re-applied on every +// client (they no longer carry over from one shared handle). These helpers +// centralize the `file:` URL construction and the per-connection PRAGMA set so +// every open site stays consistent. +// +// libSQL reads existing on-disk SQLite files (the legacy pre-FumaDB / pre-scope +// databases) directly via a `file:` URL — same file format — so the one-time +// legacy import/migration path works against the same files, just through the +// async libSQL client instead of synchronous bun:sqlite. +// --------------------------------------------------------------------------- + +/** + * Build a libSQL `file:` URL from a filesystem path. libSQL requires an + * absolute path for `file:` URLs; `:memory:` passes through unchanged. + */ +export const toLibsqlFileUrl = (path: string): string => + path === ":memory:" ? path : `file:${resolve(path)}`; + +/** + * Open a libSQL client for a local on-disk DB and apply the per-connection + * PRAGMAs (foreign_keys + WAL). Used for the long-lived FumaDB handle and the + * live one-shot google-discovery migration. + */ +export const openLocalLibsql = async (path: string): Promise => { + const client = createClient({ url: toLibsqlFileUrl(path) }); + // foreign_keys is strictly per-connection; WAL is a file-level mode set on + // first enabling. Re-apply both since libSQL gives no shared handle. + await client.execute("PRAGMA foreign_keys = ON"); + await client.execute("PRAGMA journal_mode = WAL"); + return client; +}; + +/** + * Open a libSQL client for reading a legacy on-disk SQLite file. Readonly + * intent is enforced by issuing only SELECT/PRAGMA reads (libSQL has no + * per-open readonly flag in the bun:sqlite sense). + */ +export const openLegacyLibsql = (path: string): Client => + createClient({ url: toLibsqlFileUrl(path) }); + +// --------------------------------------------------------------------------- +// Typed query boundary. `@libsql/client` returns rows as the structural `Row` +// type (array-like with named getters). The legacy importers/probes read known +// column shapes off those rows, so this is the single place where the dynamic +// SQLite result is narrowed to the caller's row type — the SQL is the schema +// contract, mirroring what bun:sqlite's `query()` generic provided. +// --------------------------------------------------------------------------- + +const asRows = (result: ResultSet): readonly T[] => + // oxlint-disable-next-line executor/no-double-cast -- boundary: the SQLite result columns are the schema contract for `T`; libSQL's `Row` is structurally the row, narrowed once here + result.rows as unknown as readonly T[]; + +/** Run a SELECT and return its rows narrowed to `T` (the SQL is the contract). */ +export const queryRows = async ( + client: Client, + sql: string, + args?: InArgs, +): Promise => asRows(await client.execute(args ? { sql, args } : sql)); + +/** Run a SELECT and return its first row narrowed to `T`, or undefined. */ +export const queryFirst = async ( + client: Client, + sql: string, + args?: InArgs, +): Promise => (await queryRows(client, sql, args))[0]; diff --git a/apps/local/src/server/main.ts b/apps/local/src/server/main.ts index 6644c4785..bce001a3a 100644 --- a/apps/local/src/server/main.ts +++ b/apps/local/src/server/main.ts @@ -1,32 +1,26 @@ -import { HttpApiBuilder, HttpApiSwagger } from "effect/unstable/httpapi"; -import { HttpRouter, HttpServer } from "effect/unstable/http"; import { Context, Effect, Layer, ManagedRuntime } from "effect"; -import { observabilityMiddleware } from "@executor-js/api"; -import { - CoreHandlers, - ExecutorService, - ExecutionEngineService, - composePluginApi, - composePluginHandlers, -} from "@executor-js/api/server"; import { createExecutionEngine } from "@executor-js/execution"; import { makeQuickJsExecutor } from "@executor-js/runtime-quickjs"; +import { makeLocalApiHandler } from "./app"; import { getExecutorBundle } from "./executor"; import { createMcpRequestHandler, type McpRequestHandler } from "./mcp"; -import { ErrorCaptureLive } from "./observability"; // --------------------------------------------------------------------------- -// Local server API. +// Local server handlers. // -// Every plugin contributes its `HttpApiGroup` and handler `Layer` through -// the spec (`routes()` / `handlers(self)` on `PluginSpec`); the host folds -// the group list into a single `HttpApi` and merges the handler layers -// into the runtime. The plugin set is the union of `executor.config.ts` -// (static, typed) and `executor.jsonc#plugins` (dynamic, jiti-loaded), -// so `LocalApi` can't be constructed until the executor bundle resolves -// — composition happens inside `createServerHandlers` instead of at -// module-eval time. +// The typed plugin `/api` is assembled by `ExecutorApp.make` (see `./app.ts`): +// the same shared facade cloud and self-host use, slotting local's single-user +// identity + the ONE boot executor (the `fixedExecution` seam) + console error +// capture + Swagger. The plugin set is the union of `executor.config.ts` +// (static, typed) and `executor.jsonc#plugins` (dynamic, jiti-loaded), resolved +// inside the boot bundle, so the composition happens after the bundle resolves +// rather than at module-eval time. +// +// The in-process `/mcp` surface stays local-platform: a single-engine handler +// over the SAME boot executor with a browser-approval store + stdio transport +// (not the shared multi-user `McpServingRoutes` envelope), built here and routed +// by the Bun shell in `serve.ts`. // --------------------------------------------------------------------------- // --------------------------------------------------------------------------- @@ -60,44 +54,18 @@ const closeServerHandlers = async (handlers: ServerHandlers): Promise => { }; export const createServerHandlers = async (): Promise => { - const { executor, plugins } = await getExecutorBundle(); - const engine = createExecutionEngine({ executor, codeExecutor: makeQuickJsExecutor() }); - - const LocalApi = composePluginApi(plugins); - // `ErrorCaptureLive` logs causes to the console and returns a short - // correlation id. Provided above the handler + middleware layers so - // both the `withCapture` typed-channel translation AND the - // `observabilityMiddleware` defect catchall see the same - // implementation. - const LocalObservability = observabilityMiddleware(LocalApi); - const LocalApiBase = HttpApiBuilder.layer(LocalApi).pipe( - Layer.provide(CoreHandlers), - Layer.provide(LocalObservability), - Layer.provide(ErrorCaptureLive), - ); - - // Spec-based plugin handlers — each plugin's `handlers(self)` Layer is - // built against its own bundled HttpApi for full type safety inside the - // plugin, and merges into the runtime `LocalApi` by group identity. - // Each plugin's handler bodies that yield its `*ExtensionService` are - // satisfied because `composePluginHandlers` provides `executor[id]` to - // the plugin's own `Layer.succeed(*ExtensionService)(self)` wiring. - const SpecPluginHandlers = composePluginHandlers(plugins, executor); - - const localApiLayer = LocalApiBase.pipe( - Layer.provideMerge(HttpApiSwagger.layer(LocalApi, { path: "/docs" })), - Layer.provideMerge(SpecPluginHandlers), - Layer.provideMerge(Layer.succeed(ExecutorService)(executor)), - Layer.provideMerge(Layer.succeed(ExecutionEngineService)(engine)), - Layer.provideMerge(HttpServer.layerServices), - Layer.provideMerge(Layer.succeed(HttpRouter.RouterConfig)({ maxParamLength: 1000 })), - ); - const api = HttpRouter.toWebHandler(localApiLayer); - const apiHandler: ServerHandlers["api"] = { - handler: (request) => api.handler(request), - dispose: api.dispose, - }; - + // The typed `/api` web-handler comes from `ExecutorApp.make` (./app.ts). + const apiHandler: ServerHandlers["api"] = await makeLocalApiHandler(); + + // The in-process MCP server runs over the SAME boot executor, with its own + // engine instance (the browser-approval + stdio surface is local-only and not + // part of the shared API). Reuse the shared boot bundle so the MCP executor is + // byte-identical to the one the API serves. + const { executor } = await getExecutorBundle(); + const engine = createExecutionEngine({ + executor, + codeExecutor: makeQuickJsExecutor(), + }); const mcp = createMcpRequestHandler({ engine }); return { api: apiHandler, mcp }; diff --git a/apps/local/src/server/mcp-browser-resume.test.ts b/apps/local/src/server/mcp-browser-resume.test.ts index ccf8a1f89..6bb1e536b 100644 --- a/apps/local/src/server/mcp-browser-resume.test.ts +++ b/apps/local/src/server/mcp-browser-resume.test.ts @@ -22,11 +22,11 @@ import { Effect, Schema } from "effect"; import { createExecutionEngine } from "@executor-js/execution"; import { makeQuickJsExecutor } from "@executor-js/runtime-quickjs"; +import { collectTables } from "@executor-js/api/server"; import { FormElicitation, Scope, ScopeId, - collectTables, createExecutor, definePlugin, type Executor, diff --git a/apps/local/src/server/mcp-oauth.test.ts b/apps/local/src/server/mcp-oauth.test.ts index 802172597..7f03de4c7 100644 --- a/apps/local/src/server/mcp-oauth.test.ts +++ b/apps/local/src/server/mcp-oauth.test.ts @@ -29,10 +29,15 @@ import { FetchHttpClient, HttpRouter, HttpServer } from "effect/unstable/http"; import { Effect, Layer } from "effect"; import { addGroup, observabilityMiddleware } from "@executor-js/api"; -import { CoreHandlers, ExecutionEngineService, ExecutorService } from "@executor-js/api/server"; +import { + CoreHandlers, + ExecutionEngineService, + ExecutorService, + collectTables, +} from "@executor-js/api/server"; import { createExecutionEngine } from "@executor-js/execution"; import { makeQuickJsExecutor } from "@executor-js/runtime-quickjs"; -import { Scope, ScopeId, collectTables, createExecutor } from "@executor-js/sdk"; +import { Scope, ScopeId, createExecutor } from "@executor-js/sdk"; import { serveOAuthTestServer } from "@executor-js/sdk/testing"; import { fileSecretsPlugin } from "@executor-js/plugin-file-secrets"; import { mcpPlugin } from "@executor-js/plugin-mcp"; diff --git a/apps/local/src/server/mcp.ts b/apps/local/src/server/mcp.ts index b6c052cd8..21d2afe1d 100644 --- a/apps/local/src/server/mcp.ts +++ b/apps/local/src/server/mcp.ts @@ -3,7 +3,11 @@ import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js"; import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js"; import { WebStandardStreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/webStandardStreamableHttp.js"; -import { createExecutorMcpServer, type ExecutorMcpServerConfig } from "@executor-js/host-mcp"; +import { jsonRpcErrorBody } from "@executor-js/host-mcp"; +import { + createExecutorMcpServer, + type ExecutorMcpServerConfig, +} from "@executor-js/host-mcp/tool-server"; import type { ResumeResponse } from "@executor-js/execution"; import { startIntegrationsRefresh } from "./integrations"; @@ -18,11 +22,11 @@ export type McpRequestHandler = { readonly close: () => Promise; }; +// Local serves these error bodies in-process; like the self-host store they are +// INNER responses (no CORS) — byte-identical to the prior hand-rolled copy +// (`content-type: application/json` only) via the canonical renderer. const jsonError = (status: number, code: number, message: string): Response => - new Response(JSON.stringify({ jsonrpc: "2.0", error: { code, message }, id: null }), { - status, - headers: { "content-type": "application/json" }, - }); + jsonRpcErrorBody(status, code, message, { cors: false }); const formatBoundaryError = (error: unknown): unknown => { // oxlint-disable-next-line executor/no-instanceof-error, executor/no-unknown-error-message -- boundary: MCP request handler catches unknown SDK/runtime failures for process logging diff --git a/apps/local/src/server/migrate-google-discovery-bindings.test.ts b/apps/local/src/server/migrate-google-discovery-bindings.test.ts index 06fbcf501..bc51b768f 100644 --- a/apps/local/src/server/migrate-google-discovery-bindings.test.ts +++ b/apps/local/src/server/migrate-google-discovery-bindings.test.ts @@ -5,14 +5,12 @@ // columns and child tables are populated. import { afterEach, describe, expect, it } from "@effect/vitest"; -import { Database } from "bun:sqlite"; import { Schema } from "effect"; import { mkdtempSync, rmSync } from "node:fs"; import { join } from "node:path"; import { tmpdir } from "node:os"; -import { drizzle } from "drizzle-orm/bun-sqlite"; -import { migrate } from "drizzle-orm/bun-sqlite/migrator"; +import { openTestDb, runMigrations } from "./__test-helpers__/libsql-test-db"; import { PRE_0007_SQL, stampPriorMigrationsApplied } from "./__test-helpers__/pre-0007-schema"; const MIGRATIONS_FOLDER = join(import.meta.dirname, "../../drizzle"); @@ -39,47 +37,48 @@ describe("0007_normalize_plugin_secret_refs (google-discovery)", () => { tempDirs.clear(); }); - it("flattens oauth2 auth into columns", () => { + it("flattens oauth2 auth into columns", async () => { const dbPath = createTempDbPath(); - const db = new Database(dbPath); - db.exec(PRE_0007_SQL); - stampPriorMigrationsApplied(db); - - db.prepare( - "INSERT INTO google_discovery_source (scope_id, id, name, config, created_at, updated_at) VALUES (?, ?, ?, ?, ?, ?)", - ).run( - "default-scope", - "drive", - "Drive", - JSON.stringify({ - name: "Drive", - discoveryUrl: "https://www.googleapis.com/discovery/v1/apis/drive/v3/rest", - service: "drive", - version: "v3", - rootUrl: "https://www.googleapis.com/", - servicePath: "drive/v3/", - auth: { - kind: "oauth2", - connectionId: "conn-1", - clientIdSecretId: "client-id", - clientSecretSecretId: "client-secret", - scopes: ["https://www.googleapis.com/auth/drive"], - }, - }), - Date.now(), - Date.now(), - ); + const db = openTestDb(dbPath); + await db.exec(PRE_0007_SQL); + await stampPriorMigrationsApplied(db); + + await db + .prepare( + "INSERT INTO google_discovery_source (scope_id, id, name, config, created_at, updated_at) VALUES (?, ?, ?, ?, ?, ?)", + ) + .run( + "default-scope", + "drive", + "Drive", + JSON.stringify({ + name: "Drive", + discoveryUrl: "https://www.googleapis.com/discovery/v1/apis/drive/v3/rest", + service: "drive", + version: "v3", + rootUrl: "https://www.googleapis.com/", + servicePath: "drive/v3/", + auth: { + kind: "oauth2", + connectionId: "conn-1", + clientIdSecretId: "client-id", + clientSecretSecretId: "client-secret", + scopes: ["https://www.googleapis.com/auth/drive"], + }, + }), + Date.now(), + Date.now(), + ); db.close(); - const drizzleDb = drizzle(new Database(dbPath)); - migrate(drizzleDb, { migrationsFolder: MIGRATIONS_FOLDER }); + await runMigrations(dbPath, MIGRATIONS_FOLDER); - const after = new Database(dbPath, { readonly: true }); - const row = after + const after = openTestDb(dbPath); + const row = (await after .prepare( "SELECT auth_kind, auth_connection_id, auth_client_id_secret_id, auth_client_secret_secret_id, auth_scopes, config FROM google_discovery_source WHERE id = ?", ) - .get("drive") as Record; + .get("drive")) as Record; expect(row.auth_kind).toBe("oauth2"); expect(row.auth_connection_id).toBe("conn-1"); expect(row.auth_client_id_secret_id).toBe("client-id"); @@ -93,50 +92,51 @@ describe("0007_normalize_plugin_secret_refs (google-discovery)", () => { after.close(); }); - it("explodes credentials.headers and queryParams into child rows", () => { + it("explodes credentials.headers and queryParams into child rows", async () => { const dbPath = createTempDbPath(); - const db = new Database(dbPath); - db.exec(PRE_0007_SQL); - stampPriorMigrationsApplied(db); - - db.prepare( - "INSERT INTO google_discovery_source (scope_id, id, name, config, created_at, updated_at) VALUES (?, ?, ?, ?, ?, ?)", - ).run( - "default-scope", - "with-creds", - "With Creds", - JSON.stringify({ - name: "With Creds", - discoveryUrl: "https://example.com/discovery", - service: "svc", - version: "v1", - rootUrl: "https://example.com/", - servicePath: "svc/v1/", - auth: { kind: "none" }, - credentials: { - headers: { - "X-Static": "literal", - Authorization: { secretId: "tok-secret", prefix: "Bearer " }, - }, - queryParams: { - api_key: { secretId: "key-secret" }, + const db = openTestDb(dbPath); + await db.exec(PRE_0007_SQL); + await stampPriorMigrationsApplied(db); + + await db + .prepare( + "INSERT INTO google_discovery_source (scope_id, id, name, config, created_at, updated_at) VALUES (?, ?, ?, ?, ?, ?)", + ) + .run( + "default-scope", + "with-creds", + "With Creds", + JSON.stringify({ + name: "With Creds", + discoveryUrl: "https://example.com/discovery", + service: "svc", + version: "v1", + rootUrl: "https://example.com/", + servicePath: "svc/v1/", + auth: { kind: "none" }, + credentials: { + headers: { + "X-Static": "literal", + Authorization: { secretId: "tok-secret", prefix: "Bearer " }, + }, + queryParams: { + api_key: { secretId: "key-secret" }, + }, }, - }, - }), - Date.now(), - Date.now(), - ); + }), + Date.now(), + Date.now(), + ); db.close(); - const drizzleDb = drizzle(new Database(dbPath)); - migrate(drizzleDb, { migrationsFolder: MIGRATIONS_FOLDER }); + await runMigrations(dbPath, MIGRATIONS_FOLDER); - const after = new Database(dbPath, { readonly: true }); - const headers = after + const after = openTestDb(dbPath); + const headers = (await after .prepare( "SELECT name, kind, text_value, secret_id, secret_prefix FROM google_discovery_source_credential_header WHERE source_id = ? ORDER BY name", ) - .all("with-creds") as ReadonlyArray>; + .all("with-creds")) as ReadonlyArray>; expect(headers).toHaveLength(2); const byName = new Map(headers.map((h) => [h.name!, h])); expect(byName.get("X-Static")).toMatchObject({ @@ -149,61 +149,62 @@ describe("0007_normalize_plugin_secret_refs (google-discovery)", () => { secret_prefix: "Bearer ", }); - const params = after + const params = (await after .prepare( "SELECT name, secret_id FROM google_discovery_source_credential_query_param WHERE source_id = ?", ) - .all("with-creds") as ReadonlyArray>; + .all("with-creds")) as ReadonlyArray>; expect(params).toHaveLength(1); expect(params[0]).toMatchObject({ name: "api_key", secret_id: "key-secret" }); after.close(); }); - it("survives auth.kind=none with no credentials", () => { + it("survives auth.kind=none with no credentials", async () => { const dbPath = createTempDbPath(); - const db = new Database(dbPath); - db.exec(PRE_0007_SQL); - stampPriorMigrationsApplied(db); - - db.prepare( - "INSERT INTO google_discovery_source (scope_id, id, name, config, created_at, updated_at) VALUES (?, ?, ?, ?, ?, ?)", - ).run( - "default-scope", - "bare", - "Bare", - JSON.stringify({ - name: "Bare", - discoveryUrl: "https://example.com/discovery", - service: "svc", - version: "v1", - rootUrl: "https://example.com/", - servicePath: "svc/v1/", - auth: { kind: "none" }, - }), - Date.now(), - Date.now(), - ); + const db = openTestDb(dbPath); + await db.exec(PRE_0007_SQL); + await stampPriorMigrationsApplied(db); + + await db + .prepare( + "INSERT INTO google_discovery_source (scope_id, id, name, config, created_at, updated_at) VALUES (?, ?, ?, ?, ?, ?)", + ) + .run( + "default-scope", + "bare", + "Bare", + JSON.stringify({ + name: "Bare", + discoveryUrl: "https://example.com/discovery", + service: "svc", + version: "v1", + rootUrl: "https://example.com/", + servicePath: "svc/v1/", + auth: { kind: "none" }, + }), + Date.now(), + Date.now(), + ); db.close(); - const drizzleDb = drizzle(new Database(dbPath)); - migrate(drizzleDb, { migrationsFolder: MIGRATIONS_FOLDER }); + await runMigrations(dbPath, MIGRATIONS_FOLDER); - const after = new Database(dbPath, { readonly: true }); - const row = after + const after = openTestDb(dbPath); + const row = (await after .prepare( "SELECT auth_kind, auth_connection_id, auth_scopes FROM google_discovery_source WHERE id = ?", ) - .get("bare") as Record; + .get("bare")) as Record; expect(row.auth_kind).toBe("none"); expect(row.auth_connection_id).toBeNull(); const headerCount = ( - after + (await after .prepare( "SELECT count(*) as n FROM google_discovery_source_credential_header WHERE source_id = ?", ) - .get("bare") as { n: number } + .get("bare")) as { n: number } ).n; expect(headerCount).toBe(0); after.close(); diff --git a/apps/local/src/server/migrate-graphql-bindings.test.ts b/apps/local/src/server/migrate-graphql-bindings.test.ts index 699d71f97..1f79485d4 100644 --- a/apps/local/src/server/migrate-graphql-bindings.test.ts +++ b/apps/local/src/server/migrate-graphql-bindings.test.ts @@ -4,14 +4,12 @@ // assert the final slot model plus shared credential_binding rows. import { afterEach, beforeEach, describe, expect, it } from "@effect/vitest"; -import { Database } from "bun:sqlite"; import { Schema } from "effect"; import { mkdtempSync, rmSync } from "node:fs"; import { join } from "node:path"; import { tmpdir } from "node:os"; -import { drizzle } from "drizzle-orm/bun-sqlite"; -import { migrate } from "drizzle-orm/bun-sqlite/migrator"; +import { openTestDb, runMigrations } from "./__test-helpers__/libsql-test-db"; import { PRE_0007_SQL, stampPriorMigrationsApplied } from "./__test-helpers__/pre-0007-schema"; const MIGRATIONS_FOLDER = join(import.meta.dirname, "../../drizzle"); @@ -51,31 +49,32 @@ afterEach(() => { }); describe("graphql credential migrations", () => { - it("moves auth json connection refs into a connection slot binding", () => { + it("moves auth json connection refs into a connection slot binding", async () => { const dbPath = join(dir, "test.sqlite"); - const db = new Database(dbPath); - db.exec(PRE_0007_SQL); - stampPriorMigrationsApplied(db); + const db = openTestDb(dbPath); + await db.exec(PRE_0007_SQL); + await stampPriorMigrationsApplied(db); - db.prepare( - "INSERT INTO graphql_source (scope_id, id, name, endpoint, auth) VALUES (?, ?, ?, ?, ?)", - ).run( - "default-scope", - "github", - "GitHub", - "https://api.github.com/graphql", - JSON.stringify({ kind: "oauth2", connectionId: "conn-1" }), - ); + await db + .prepare( + "INSERT INTO graphql_source (scope_id, id, name, endpoint, auth) VALUES (?, ?, ?, ?, ?)", + ) + .run( + "default-scope", + "github", + "GitHub", + "https://api.github.com/graphql", + JSON.stringify({ kind: "oauth2", connectionId: "conn-1" }), + ); db.close(); - const drizzleDb = drizzle(new Database(dbPath)); - migrate(drizzleDb, { migrationsFolder: MIGRATIONS_FOLDER }); + await runMigrations(dbPath, MIGRATIONS_FOLDER); - const after = new Database(dbPath, { readonly: true }); + const after = openTestDb(dbPath); const source = decodePluginStorageData( decodePluginStorageRow( - after + await after .prepare( "SELECT data FROM plugin_storage WHERE plugin_id = ? AND collection = ? AND key = ?", ) @@ -85,7 +84,7 @@ describe("graphql credential migrations", () => { expect(source.auth.kind).toBe("oauth2"); expect(source.auth.connectionSlot).toBe("auth:oauth2:connection"); const bindings = decodeBindingRows( - after + await after .prepare( "SELECT scope_id, plugin_id, source_id, source_scope_id, slot_key, kind, secret_id, connection_id FROM credential_binding WHERE plugin_id = ? ORDER BY slot_key", ) @@ -104,7 +103,9 @@ describe("graphql credential migrations", () => { }, ]); // Old json column is gone. - const cols = decodeTableInfoRows(after.prepare("PRAGMA table_info('graphql_source')").all()); + const cols = decodeTableInfoRows( + await after.prepare("PRAGMA table_info('graphql_source')").all(), + ); expect(cols.some((c) => c.name === "auth")).toBe(false); expect(cols.some((c) => c.name === "headers")).toBe(false); expect(cols.some((c) => c.name === "query_params")).toBe(false); @@ -112,11 +113,11 @@ describe("graphql credential migrations", () => { after.close(); }); - it("explodes header/query_param json into slots and credential bindings", () => { + it("explodes header/query_param json into slots and credential bindings", async () => { const dbPath = join(dir, "test.sqlite"); - const db = new Database(dbPath); - db.exec(PRE_0007_SQL); - stampPriorMigrationsApplied(db); + const db = openTestDb(dbPath); + await db.exec(PRE_0007_SQL); + await stampPriorMigrationsApplied(db); const headers = { // Literal text header. @@ -130,27 +131,28 @@ describe("graphql credential migrations", () => { api_key: { secretId: "sec-key" }, }; - db.prepare( - "INSERT INTO graphql_source (scope_id, id, name, endpoint, headers, query_params, auth) VALUES (?, ?, ?, ?, ?, ?, ?)", - ).run( - "default-scope", - "example", - "Example", - "https://example.com/graphql", - JSON.stringify(headers), - JSON.stringify(queryParams), - JSON.stringify({ kind: "none" }), - ); + await db + .prepare( + "INSERT INTO graphql_source (scope_id, id, name, endpoint, headers, query_params, auth) VALUES (?, ?, ?, ?, ?, ?, ?)", + ) + .run( + "default-scope", + "example", + "Example", + "https://example.com/graphql", + JSON.stringify(headers), + JSON.stringify(queryParams), + JSON.stringify({ kind: "none" }), + ); db.close(); - const drizzleDb = drizzle(new Database(dbPath)); - migrate(drizzleDb, { migrationsFolder: MIGRATIONS_FOLDER }); + await runMigrations(dbPath, MIGRATIONS_FOLDER); - const after = new Database(dbPath, { readonly: true }); + const after = openTestDb(dbPath); const source = decodePluginStorageData( decodePluginStorageRow( - after + await after .prepare( "SELECT data FROM plugin_storage WHERE plugin_id = ? AND collection = ? AND key = ?", ) @@ -171,7 +173,7 @@ describe("graphql credential migrations", () => { }); const bindings = decodeBindingRows( - after + await after .prepare( "SELECT scope_id, plugin_id, source_id, source_scope_id, slot_key, kind, secret_id, connection_id FROM credential_binding WHERE plugin_id = ? ORDER BY slot_key", ) @@ -186,83 +188,77 @@ describe("graphql credential migrations", () => { after.close(); }); - it("fails instead of silently collapsing colliding legacy query parameter slots", () => { + it("fails instead of silently collapsing colliding legacy query parameter slots", async () => { const dbPath = join(dir, "test.sqlite"); - const db = new Database(dbPath); - db.exec(PRE_0007_SQL); - stampPriorMigrationsApplied(db); + const db = openTestDb(dbPath); + await db.exec(PRE_0007_SQL); + await stampPriorMigrationsApplied(db); - db.prepare( - "INSERT INTO graphql_source (scope_id, id, name, endpoint, query_params, auth) VALUES (?, ?, ?, ?, ?, ?)", - ).run( - "default-scope", - "collision", - "Collision", - "https://example.com/graphql", - JSON.stringify({ - api_key: { secretId: "sec-underscore" }, - "api-key": { secretId: "sec-dash" }, - }), - JSON.stringify({ kind: "none" }), - ); + await db + .prepare( + "INSERT INTO graphql_source (scope_id, id, name, endpoint, query_params, auth) VALUES (?, ?, ?, ?, ?, ?)", + ) + .run( + "default-scope", + "collision", + "Collision", + "https://example.com/graphql", + JSON.stringify({ + api_key: { secretId: "sec-underscore" }, + "api-key": { secretId: "sec-dash" }, + }), + JSON.stringify({ kind: "none" }), + ); db.close(); - const sqlite = new Database(dbPath); - const drizzleDb = drizzle(sqlite); - expect(() => migrate(drizzleDb, { migrationsFolder: MIGRATIONS_FOLDER })).toThrow(); - sqlite.close(); + await expect(runMigrations(dbPath, MIGRATIONS_FOLDER)).rejects.toThrow(); }); - it("fails instead of silently collapsing colliding legacy header slots", () => { + it("fails instead of silently collapsing colliding legacy header slots", async () => { const dbPath = join(dir, "test.sqlite"); - const db = new Database(dbPath); - db.exec(PRE_0007_SQL); - stampPriorMigrationsApplied(db); + const db = openTestDb(dbPath); + await db.exec(PRE_0007_SQL); + await stampPriorMigrationsApplied(db); - db.prepare( - "INSERT INTO graphql_source (scope_id, id, name, endpoint, headers, auth) VALUES (?, ?, ?, ?, ?, ?)", - ).run( - "default-scope", - "collision", - "Collision", - "https://example.com/graphql", - JSON.stringify({ - x_token: { secretId: "sec-underscore" }, - "x-token": { secretId: "sec-dash" }, - }), - JSON.stringify({ kind: "none" }), - ); + await db + .prepare( + "INSERT INTO graphql_source (scope_id, id, name, endpoint, headers, auth) VALUES (?, ?, ?, ?, ?, ?)", + ) + .run( + "default-scope", + "collision", + "Collision", + "https://example.com/graphql", + JSON.stringify({ + x_token: { secretId: "sec-underscore" }, + "x-token": { secretId: "sec-dash" }, + }), + JSON.stringify({ kind: "none" }), + ); db.close(); - const sqlite = new Database(dbPath); - const drizzleDb = drizzle(sqlite); - expect(() => migrate(drizzleDb, { migrationsFolder: MIGRATIONS_FOLDER })).toThrow(); - sqlite.close(); + await expect(runMigrations(dbPath, MIGRATIONS_FOLDER)).rejects.toThrow(); }); - it("handles graphql_source rows with null json (empty config)", () => { + it("handles graphql_source rows with null json (empty config)", async () => { const dbPath = join(dir, "test.sqlite"); - const db = new Database(dbPath); - db.exec(PRE_0007_SQL); - stampPriorMigrationsApplied(db); + const db = openTestDb(dbPath); + await db.exec(PRE_0007_SQL); + await stampPriorMigrationsApplied(db); - db.prepare("INSERT INTO graphql_source (scope_id, id, name, endpoint) VALUES (?, ?, ?, ?)").run( - "default-scope", - "bare", - "Bare", - "https://bare.example/graphql", - ); + await db + .prepare("INSERT INTO graphql_source (scope_id, id, name, endpoint) VALUES (?, ?, ?, ?)") + .run("default-scope", "bare", "Bare", "https://bare.example/graphql"); db.close(); - const drizzleDb = drizzle(new Database(dbPath)); - migrate(drizzleDb, { migrationsFolder: MIGRATIONS_FOLDER }); + await runMigrations(dbPath, MIGRATIONS_FOLDER); - const after = new Database(dbPath, { readonly: true }); + const after = openTestDb(dbPath); const source = decodePluginStorageData( decodePluginStorageRow( - after + await after .prepare( "SELECT data FROM plugin_storage WHERE plugin_id = ? AND collection = ? AND key = ?", ) @@ -274,23 +270,23 @@ describe("graphql credential migrations", () => { after.close(); }); - it("does not collapse child rows whose source/name pairs share colon-concatenated ids", () => { + it("does not collapse child rows whose source/name pairs share colon-concatenated ids", async () => { const dbPath = join(dir, "test.sqlite"); - const db = new Database(dbPath); - db.exec(PRE_0007_SQL); - stampPriorMigrationsApplied(db); + const db = openTestDb(dbPath); + await db.exec(PRE_0007_SQL); + await stampPriorMigrationsApplied(db); const insert = db.prepare( "INSERT INTO graphql_source (scope_id, id, name, endpoint, headers) VALUES (?, ?, ?, ?, ?)", ); - insert.run( + await insert.run( "default-scope", "a:b", "First", "https://first.example/graphql", JSON.stringify({ c: "first" }), ); - insert.run( + await insert.run( "default-scope", "a", "Second", @@ -299,19 +295,22 @@ describe("graphql credential migrations", () => { ); db.close(); - const drizzleDb = drizzle(new Database(dbPath)); - migrate(drizzleDb, { migrationsFolder: MIGRATIONS_FOLDER }); + await runMigrations(dbPath, MIGRATIONS_FOLDER); - const after = new Database(dbPath, { readonly: true }); - const rows = after - .prepare( - "SELECT key, data FROM plugin_storage WHERE plugin_id = ? AND collection = ? ORDER BY key", - ) - .all("graphql", "source") - .map((row) => { - const decoded = decodePluginStorageRow(row); - return { key: (row as { key: string }).key, data: decodePluginStorageData(decoded.data) }; - }) as ReadonlyArray<{ + const after = openTestDb(dbPath); + const rows = ( + await after + .prepare( + "SELECT key, data FROM plugin_storage WHERE plugin_id = ? AND collection = ? ORDER BY key", + ) + .all<{ key: string; data: string }>("graphql", "source") + ).map((row) => { + const decoded = decodePluginStorageRow(row); + return { + key: row.key, + data: decodePluginStorageData(decoded.data), + }; + }) as ReadonlyArray<{ readonly key: string; readonly data: { readonly headers: Record }; }>; diff --git a/apps/local/src/server/migrate-mcp-bindings.test.ts b/apps/local/src/server/migrate-mcp-bindings.test.ts index 6b00033a9..596dad15b 100644 --- a/apps/local/src/server/migrate-mcp-bindings.test.ts +++ b/apps/local/src/server/migrate-mcp-bindings.test.ts @@ -4,14 +4,12 @@ // rows. import { afterEach, describe, expect, it } from "@effect/vitest"; -import { Database } from "bun:sqlite"; import { mkdtempSync, rmSync } from "node:fs"; import { join } from "node:path"; import { tmpdir } from "node:os"; -import { drizzle } from "drizzle-orm/bun-sqlite"; -import { migrate } from "drizzle-orm/bun-sqlite/migrator"; import { Schema } from "effect"; +import { openTestDb, runMigrations } from "./__test-helpers__/libsql-test-db"; import { PRE_0007_SQL, stampPriorMigrationsApplied } from "./__test-helpers__/pre-0007-schema"; const MIGRATIONS_FOLDER = join(import.meta.dirname, "../../drizzle"); @@ -35,39 +33,40 @@ describe("mcp credential migrations", () => { } }); - it("moves header auth into an auth slot and credential binding", () => { + it("moves header auth into an auth slot and credential binding", async () => { const dbPath = makeDbPath(); - const db = new Database(dbPath); - db.exec(PRE_0007_SQL); - stampPriorMigrationsApplied(db); + const db = openTestDb(dbPath); + await db.exec(PRE_0007_SQL); + await stampPriorMigrationsApplied(db); - db.prepare( - "INSERT INTO mcp_source (scope_id, id, name, config, created_at) VALUES (?, ?, ?, ?, ?)", - ).run( - "default-scope", - "remote-headers", - "Remote Headers", - JSON.stringify({ - transport: "remote", - endpoint: "https://example.com/mcp", - auth: { - kind: "header", - headerName: "X-API-Key", - secretId: "tok-secret", - prefix: "Bearer ", - }, - }), - Date.now(), - ); + await db + .prepare( + "INSERT INTO mcp_source (scope_id, id, name, config, created_at) VALUES (?, ?, ?, ?, ?)", + ) + .run( + "default-scope", + "remote-headers", + "Remote Headers", + JSON.stringify({ + transport: "remote", + endpoint: "https://example.com/mcp", + auth: { + kind: "header", + headerName: "X-API-Key", + secretId: "tok-secret", + prefix: "Bearer ", + }, + }), + Date.now(), + ); db.close(); - const drizzleDb = drizzle(new Database(dbPath)); - migrate(drizzleDb, { migrationsFolder: MIGRATIONS_FOLDER }); + await runMigrations(dbPath, MIGRATIONS_FOLDER); - const after = new Database(dbPath, { readonly: true }); + const after = openTestDb(dbPath); const source = decodePluginStorageData( decodePluginStorageRow( - after + await after .prepare( "SELECT data FROM plugin_storage WHERE plugin_id = ? AND collection = ? AND key = ?", ) @@ -91,11 +90,11 @@ describe("mcp credential migrations", () => { secretSlot: "auth:header", prefix: "Bearer ", }); - const binding = after + const binding = (await after .prepare( "SELECT slot_key, kind, secret_id FROM credential_binding WHERE plugin_id = ? AND source_id = ? AND slot_key = ?", ) - .get("mcp", "remote-headers", "auth:header") as Record; + .get("mcp", "remote-headers", "auth:header")) as Record; expect(binding).toMatchObject({ slot_key: "auth:header", kind: "secret", @@ -106,46 +105,47 @@ describe("mcp credential migrations", () => { after.close(); }); - it("moves oauth2 auth and request credentials into slots and bindings", () => { + it("moves oauth2 auth and request credentials into slots and bindings", async () => { const dbPath = makeDbPath(); - const db = new Database(dbPath); - db.exec(PRE_0007_SQL); - stampPriorMigrationsApplied(db); + const db = openTestDb(dbPath); + await db.exec(PRE_0007_SQL); + await stampPriorMigrationsApplied(db); - db.prepare( - "INSERT INTO mcp_source (scope_id, id, name, config, created_at) VALUES (?, ?, ?, ?, ?)", - ).run( - "default-scope", - "remote-oauth", - "Remote OAuth", - JSON.stringify({ - transport: "remote", - endpoint: "https://oauth.example/mcp", - headers: { - "X-Trace": "static", - "X-Token": { secretId: "extra-tok" }, - }, - queryParams: { - org: { secretId: "org-id-secret" }, - }, - auth: { - kind: "oauth2", - connectionId: "conn-1", - clientIdSecretId: "client-id-sec", - clientSecretSecretId: "client-secret-sec", - }, - }), - Date.now(), - ); + await db + .prepare( + "INSERT INTO mcp_source (scope_id, id, name, config, created_at) VALUES (?, ?, ?, ?, ?)", + ) + .run( + "default-scope", + "remote-oauth", + "Remote OAuth", + JSON.stringify({ + transport: "remote", + endpoint: "https://oauth.example/mcp", + headers: { + "X-Trace": "static", + "X-Token": { secretId: "extra-tok" }, + }, + queryParams: { + org: { secretId: "org-id-secret" }, + }, + auth: { + kind: "oauth2", + connectionId: "conn-1", + clientIdSecretId: "client-id-sec", + clientSecretSecretId: "client-secret-sec", + }, + }), + Date.now(), + ); db.close(); - const drizzleDb = drizzle(new Database(dbPath)); - migrate(drizzleDb, { migrationsFolder: MIGRATIONS_FOLDER }); + await runMigrations(dbPath, MIGRATIONS_FOLDER); - const after = new Database(dbPath, { readonly: true }); + const after = openTestDb(dbPath); const source = decodePluginStorageData( decodePluginStorageRow( - after + await after .prepare( "SELECT data FROM plugin_storage WHERE plugin_id = ? AND collection = ? AND key = ?", ) @@ -165,11 +165,11 @@ describe("mcp credential migrations", () => { clientSecretSlot: "auth:oauth2:client-secret", }); - const authBindings = after + const authBindings = (await after .prepare( "SELECT slot_key, kind, secret_id, connection_id FROM credential_binding WHERE plugin_id = ? AND source_id = ? ORDER BY slot_key", ) - .all("mcp", "remote-oauth") as ReadonlyArray>; + .all("mcp", "remote-oauth")) as ReadonlyArray>; const bySlot = new Map(authBindings.map((binding) => [binding.slot_key, binding])); expect(bySlot.get("auth:oauth2:connection")).toMatchObject({ kind: "connection", @@ -205,64 +205,64 @@ describe("mcp credential migrations", () => { after.close(); }); - it("fails instead of silently collapsing colliding legacy header slots", () => { + it("fails instead of silently collapsing colliding legacy header slots", async () => { const dbPath = makeDbPath(); - const db = new Database(dbPath); - db.exec(PRE_0007_SQL); - stampPriorMigrationsApplied(db); + const db = openTestDb(dbPath); + await db.exec(PRE_0007_SQL); + await stampPriorMigrationsApplied(db); - db.prepare( - "INSERT INTO mcp_source (scope_id, id, name, config, created_at) VALUES (?, ?, ?, ?, ?)", - ).run( - "default-scope", - "collision", - "Collision", - JSON.stringify({ - transport: "remote", - endpoint: "https://example.com/mcp", - headers: { - x_token: { secretId: "sec-underscore" }, - "x-token": { secretId: "sec-dash" }, - }, - }), - Date.now(), - ); + await db + .prepare( + "INSERT INTO mcp_source (scope_id, id, name, config, created_at) VALUES (?, ?, ?, ?, ?)", + ) + .run( + "default-scope", + "collision", + "Collision", + JSON.stringify({ + transport: "remote", + endpoint: "https://example.com/mcp", + headers: { + x_token: { secretId: "sec-underscore" }, + "x-token": { secretId: "sec-dash" }, + }, + }), + Date.now(), + ); db.close(); - const sqlite = new Database(dbPath); - const drizzleDb = drizzle(sqlite); - expect(() => migrate(drizzleDb, { migrationsFolder: MIGRATIONS_FOLDER })).toThrow(); - sqlite.close(); + await expect(runMigrations(dbPath, MIGRATIONS_FOLDER)).rejects.toThrow(); }); - it("leaves stdio sources alone (no auth, no headers, no queryParams)", () => { + it("leaves stdio sources alone (no auth, no headers, no queryParams)", async () => { const dbPath = makeDbPath(); - const db = new Database(dbPath); - db.exec(PRE_0007_SQL); - stampPriorMigrationsApplied(db); + const db = openTestDb(dbPath); + await db.exec(PRE_0007_SQL); + await stampPriorMigrationsApplied(db); - db.prepare( - "INSERT INTO mcp_source (scope_id, id, name, config, created_at) VALUES (?, ?, ?, ?, ?)", - ).run( - "default-scope", - "stdio-only", - "Stdio", - JSON.stringify({ - transport: "stdio", - command: "/usr/bin/server", - args: ["--flag"], - }), - Date.now(), - ); + await db + .prepare( + "INSERT INTO mcp_source (scope_id, id, name, config, created_at) VALUES (?, ?, ?, ?, ?)", + ) + .run( + "default-scope", + "stdio-only", + "Stdio", + JSON.stringify({ + transport: "stdio", + command: "/usr/bin/server", + args: ["--flag"], + }), + Date.now(), + ); db.close(); - const drizzleDb = drizzle(new Database(dbPath)); - migrate(drizzleDb, { migrationsFolder: MIGRATIONS_FOLDER }); + await runMigrations(dbPath, MIGRATIONS_FOLDER); - const after = new Database(dbPath, { readonly: true }); + const after = openTestDb(dbPath); const source = decodePluginStorageData( decodePluginStorageRow( - after + await after .prepare( "SELECT data FROM plugin_storage WHERE plugin_id = ? AND collection = ? AND key = ?", ) diff --git a/apps/local/src/server/migrate-oauth-connections.test.ts b/apps/local/src/server/migrate-oauth-connections.test.ts index 795467d5e..680a371b8 100644 --- a/apps/local/src/server/migrate-oauth-connections.test.ts +++ b/apps/local/src/server/migrate-oauth-connections.test.ts @@ -1,5 +1,5 @@ import { afterEach, beforeEach, describe, expect, it } from "@effect/vitest"; -import { Database } from "bun:sqlite"; +import { openTestDb, type LibsqlTestDb } from "./__test-helpers__/libsql-test-db"; import { mkdtempSync, readFileSync, rmSync } from "node:fs"; import { tmpdir } from "node:os"; import { join } from "node:path"; @@ -12,12 +12,12 @@ const REPAIR_MIGRATION = join( ); let workDir: string; -let db: Database; +let db: LibsqlTestDb; -beforeEach(() => { +beforeEach(async () => { workDir = mkdtempSync(join(tmpdir(), "executor-oauth-conn-mig-")); - db = new Database(join(workDir, "data.db")); - db.exec(` + db = openTestDb(join(workDir, "data.db")); + await db.exec(` CREATE TABLE \`connection\` ( \`id\` text NOT NULL, \`scope_id\` text NOT NULL, @@ -55,12 +55,12 @@ const oauthConnectionMigrationSql = () => { }; describe("0008_scoped_credentials_cutover OAuth connection section", () => { - it("rewrites old OAuth provider keys and provider_state into the canonical oauth2 shape", () => { + it("rewrites old OAuth provider keys and provider_state into the canonical oauth2 shape", async () => { const now = Date.now(); - const insert = db.prepare( + const insert = await db.prepare( "INSERT INTO `connection` (id, scope_id, provider, provider_state, scope, updated_at) VALUES (?, ?, ?, ?, ?, ?)", ); - insert.run( + await insert.run( "openapi-conn", "scope-1", "openapi:oauth2", @@ -74,7 +74,7 @@ describe("0008_scoped_credentials_cutover OAuth connection section", () => { "read", now, ); - insert.run( + await insert.run( "mcp-conn", "scope-1", "mcp:oauth2", @@ -89,7 +89,7 @@ describe("0008_scoped_credentials_cutover OAuth connection section", () => { null, now, ); - insert.run( + await insert.run( "google-conn", "scope-1", "google-discovery:oauth2", @@ -102,10 +102,10 @@ describe("0008_scoped_credentials_cutover OAuth connection section", () => { now, ); - db.exec(oauthConnectionMigrationSql()); + await db.exec(oauthConnectionMigrationSql()); const rows = decodeConnectionRows( - db.prepare("SELECT provider, provider_state FROM `connection` ORDER BY id").all(), + await db.prepare("SELECT provider, provider_state FROM `connection` ORDER BY id").all(), ); expect(rows.map((row) => row.provider)).toEqual(["oauth2", "oauth2", "oauth2"]); const [google, mcp, openapi] = rows.map((row) => decodeJsonRecord(row.provider_state)); @@ -132,9 +132,9 @@ describe("0008_scoped_credentials_cutover OAuth connection section", () => { }); describe("0009_repair_openapi_oauth_cutover_residue", () => { - it("repairs already-canonical OpenAPI rows and restores user-scoped OAuth secret bindings", () => { + it("repairs already-canonical OpenAPI rows and restores user-scoped OAuth secret bindings", async () => { const now = Date.now(); - db.exec(` + await db.exec(` CREATE TABLE \`openapi_source\` ( \`id\` text NOT NULL, \`scope_id\` text NOT NULL, @@ -158,7 +158,7 @@ describe("0009_repair_openapi_oauth_cutover_residue", () => { ); `); - db.prepare("INSERT INTO `openapi_source` (id, scope_id, oauth2) VALUES (?, ?, ?)").run( + await db.prepare("INSERT INTO `openapi_source` (id, scope_id, oauth2) VALUES (?, ?, ?)").run( "example_api", "org-1", JSON.stringify({ @@ -170,10 +170,10 @@ describe("0009_repair_openapi_oauth_cutover_residue", () => { }), ); - const insertConnection = db.prepare( + const insertConnection = await db.prepare( "INSERT INTO `connection` (id, scope_id, provider, provider_state, scope, updated_at) VALUES (?, ?, ?, ?, ?, ?)", ); - insertConnection.run( + await insertConnection.run( "openapi-oauth2-app-example_api", "org-1", "oauth2", @@ -186,7 +186,7 @@ describe("0009_repair_openapi_oauth_cutover_residue", () => { null, now, ); - insertConnection.run( + await insertConnection.run( "openapi-oauth2-app-example_api", "user-org:user-jd:org-1", "openapi:oauth2", @@ -200,10 +200,10 @@ describe("0009_repair_openapi_oauth_cutover_residue", () => { now, ); - const insertBinding = db.prepare( + const insertBinding = await db.prepare( "INSERT INTO `credential_binding` (id, scope_id, plugin_id, source_id, source_scope_id, slot_key, kind, text_value, secret_id, connection_id, created_at, updated_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)", ); - insertBinding.run( + await insertBinding.run( "org-client-id", "org-1", "openapi", @@ -217,7 +217,7 @@ describe("0009_repair_openapi_oauth_cutover_residue", () => { now, now, ); - insertBinding.run( + await insertBinding.run( "org-client-secret", "org-1", "openapi", @@ -231,7 +231,7 @@ describe("0009_repair_openapi_oauth_cutover_residue", () => { now, now, ); - insertBinding.run( + await insertBinding.run( "org-connection", "org-1", "openapi", @@ -245,7 +245,7 @@ describe("0009_repair_openapi_oauth_cutover_residue", () => { now, now, ); - insertBinding.run( + await insertBinding.run( "jd-connection", "user-org:user-jd:org-1", "openapi", @@ -260,18 +260,26 @@ describe("0009_repair_openapi_oauth_cutover_residue", () => { now, ); - db.exec(readFileSync(REPAIR_MIGRATION, "utf-8")); + await db.exec(readFileSync(REPAIR_MIGRATION, "utf-8")); const providers = decodeConnectionRows( - db.prepare("SELECT provider, provider_state FROM `connection` ORDER BY scope_id").all(), + await db.prepare("SELECT provider, provider_state FROM `connection` ORDER BY scope_id").all(), ); expect(providers.map((row) => row.provider)).toEqual(["oauth2", "oauth2"]); - const bindings = db - .prepare( - "SELECT scope_id, slot_key, kind, secret_id, connection_id FROM `credential_binding` WHERE source_id = ? ORDER BY scope_id, slot_key", - ) - .all("example_api"); + const bindings = ( + await db + .prepare( + "SELECT scope_id, slot_key, kind, secret_id, connection_id FROM `credential_binding` WHERE source_id = ? ORDER BY scope_id, slot_key", + ) + .all("example_api") + ).map((row) => ({ + scope_id: row.scope_id, + slot_key: row.slot_key, + kind: row.kind, + secret_id: row.secret_id, + connection_id: row.connection_id, + })); expect(bindings).toEqual([ { scope_id: "org-1", diff --git a/apps/local/src/server/migrate-openapi-bindings.test.ts b/apps/local/src/server/migrate-openapi-bindings.test.ts index cc4503100..bdf7f6171 100644 --- a/apps/local/src/server/migrate-openapi-bindings.test.ts +++ b/apps/local/src/server/migrate-openapi-bindings.test.ts @@ -6,14 +6,12 @@ // child rows and shared credential bindings match the old data. import { afterEach, beforeEach, describe, expect, it } from "@effect/vitest"; -import { Database } from "bun:sqlite"; import { mkdtempSync, rmSync } from "node:fs"; import { join } from "node:path"; import { tmpdir } from "node:os"; import { Schema } from "effect"; -import { drizzle } from "drizzle-orm/bun-sqlite"; -import { migrate } from "drizzle-orm/bun-sqlite/migrator"; +import { LibsqlTestDb, openTestDb, runMigrations } from "./__test-helpers__/libsql-test-db"; import { PRE_0007_SQL, stampPriorMigrationsApplied } from "./__test-helpers__/pre-0007-schema"; const MIGRATIONS_FOLDER = join(import.meta.dirname, "../../drizzle"); @@ -47,7 +45,7 @@ const decodePluginStorageData = Schema.decodeUnknownSync(Schema.fromJsonString(S describe("0007_normalize_plugin_secret_refs (openapi)", () => { let dir: string; let dbPath: string; - let openDatabases: Set; + let openDatabases: Set; beforeEach(() => { dir = mkdtempSync(join(tmpdir(), "openapi-mig-")); @@ -63,28 +61,28 @@ describe("0007_normalize_plugin_secret_refs (openapi)", () => { rmSync(dir, { recursive: true, force: true }); }); - const openDatabase = (...args: ConstructorParameters) => { - const db = new Database(...args); + const openDatabase = (path: string) => { + const db = openTestDb(path); openDatabases.add(db); return db; }; - const closeDatabase = (db: Database) => { + const closeDatabase = (db: LibsqlTestDb) => { db.close(); openDatabases.delete(db); }; - it("moves openapi_source_binding rows into shared credential_binding", () => { + it("moves openapi_source_binding rows into shared credential_binding", async () => { const db = openDatabase(dbPath); - db.exec(PRE_0007_SQL); - stampPriorMigrationsApplied(db); + await db.exec(PRE_0007_SQL); + await stampPriorMigrationsApplied(db); // Seed three bindings, one per kind. - const insert = db.prepare( + const insert = await db.prepare( "INSERT INTO openapi_source_binding (id, source_id, source_scope_id, target_scope_id, slot, value, created_at, updated_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?)", ); const now = Date.now(); - insert.run( + await insert.run( "b1", "src", "default-scope", @@ -94,7 +92,7 @@ describe("0007_normalize_plugin_secret_refs (openapi)", () => { now, now, ); - insert.run( + await insert.run( "b2", "src", "default-scope", @@ -104,7 +102,7 @@ describe("0007_normalize_plugin_secret_refs (openapi)", () => { now, now, ); - insert.run( + await insert.run( "b3", "src", "default-scope", @@ -118,20 +116,19 @@ describe("0007_normalize_plugin_secret_refs (openapi)", () => { // Need the parent openapi_source row so the source_id FK ergonomics // are satisfied for any cascading delete logic, though the binding // table has no DB-level FK, code paths assume the parent exists. - db.prepare( - "INSERT INTO openapi_source (scope_id, id, name, spec, invocation_config) VALUES (?, ?, ?, ?, ?)", - ).run("default-scope", "src", "Source", "{}", "{}"); + await db + .prepare( + "INSERT INTO openapi_source (scope_id, id, name, spec, invocation_config) VALUES (?, ?, ?, ?, ?)", + ) + .run("default-scope", "src", "Source", "{}", "{}"); closeDatabase(db); - const drizzleSqlite = openDatabase(dbPath); - const drizzleDb = drizzle(drizzleSqlite); - migrate(drizzleDb, { migrationsFolder: MIGRATIONS_FOLDER }); - closeDatabase(drizzleSqlite); + await runMigrations(dbPath, MIGRATIONS_FOLDER); - const after = openDatabase(dbPath, { readonly: true }); + const after = openDatabase(dbPath); const rows = decodeBindingRows( - after + await after .prepare( "SELECT id, scope_id, plugin_id, source_id, source_scope_id, slot_key, kind, secret_id, connection_id, text_value FROM credential_binding ORDER BY id", ) @@ -175,7 +172,7 @@ describe("0007_normalize_plugin_secret_refs (openapi)", () => { text_value: null, }); const oldTableCount = decodeCountRow( - after + await after .prepare( "SELECT count(*) as n FROM sqlite_master WHERE type = 'table' AND name = 'openapi_source_binding'", ) @@ -184,10 +181,10 @@ describe("0007_normalize_plugin_secret_refs (openapi)", () => { expect(oldTableCount.n).toBe(0); }); - it("explodes query_params and specFetchCredentials json into child slot rows", () => { + it("explodes query_params and specFetchCredentials json into child slot rows", async () => { const db = openDatabase(dbPath); - db.exec(PRE_0007_SQL); - stampPriorMigrationsApplied(db); + await db.exec(PRE_0007_SQL); + await stampPriorMigrationsApplied(db); const queryParams = { api_key: { secretId: "qp-secret" }, @@ -202,29 +199,28 @@ describe("0007_normalize_plugin_secret_refs (openapi)", () => { }, }; - db.prepare( - "INSERT INTO openapi_source (scope_id, id, name, spec, query_params, invocation_config) VALUES (?, ?, ?, ?, ?, ?)", - ).run( - "default-scope", - "src", - "Source", - "{}", - JSON.stringify(queryParams), - JSON.stringify(invocationConfig), - ); + await db + .prepare( + "INSERT INTO openapi_source (scope_id, id, name, spec, query_params, invocation_config) VALUES (?, ?, ?, ?, ?, ?)", + ) + .run( + "default-scope", + "src", + "Source", + "{}", + JSON.stringify(queryParams), + JSON.stringify(invocationConfig), + ); closeDatabase(db); - const drizzleSqlite = openDatabase(dbPath); - const drizzleDb = drizzle(drizzleSqlite); - migrate(drizzleDb, { migrationsFolder: MIGRATIONS_FOLDER }); - closeDatabase(drizzleSqlite); + await runMigrations(dbPath, MIGRATIONS_FOLDER); - const after = openDatabase(dbPath, { readonly: true }); + const after = openDatabase(dbPath); const sourceData = decodePluginStorageData( decodePluginStorageRow( - after + await after .prepare( "SELECT data FROM plugin_storage WHERE plugin_id = ? AND collection = ? AND key = ?", ) @@ -253,7 +249,7 @@ describe("0007_normalize_plugin_secret_refs (openapi)", () => { slot: "spec_fetch_query_param:token", }); const oldQueryParamTableCount = decodeCountRow( - after + await after .prepare( "SELECT count(*) as n FROM sqlite_master WHERE type = 'table' AND name = 'openapi_source_query_param'", ) @@ -262,7 +258,7 @@ describe("0007_normalize_plugin_secret_refs (openapi)", () => { expect(oldQueryParamTableCount.n).toBe(0); const bindings = decodeBindingRows( - after + await after .prepare( "SELECT id, scope_id, plugin_id, source_id, source_scope_id, slot_key, kind, secret_id, connection_id, text_value FROM credential_binding WHERE source_id = ? ORDER BY slot_key", ) @@ -275,7 +271,7 @@ describe("0007_normalize_plugin_secret_refs (openapi)", () => { ]); const oldSourceTableCount = decodeCountRow( - after + await after .prepare( "SELECT count(*) as n FROM sqlite_master WHERE type = 'table' AND name = 'openapi_source'", ) @@ -284,64 +280,62 @@ describe("0007_normalize_plugin_secret_refs (openapi)", () => { expect(oldSourceTableCount.n).toBe(0); }); - it("fails instead of silently collapsing colliding legacy query parameter slots", () => { + it("fails instead of silently collapsing colliding legacy query parameter slots", async () => { const db = openDatabase(dbPath); - db.exec(PRE_0007_SQL); - stampPriorMigrationsApplied(db); - - db.prepare( - "INSERT INTO openapi_source (scope_id, id, name, spec, query_params, invocation_config) VALUES (?, ?, ?, ?, ?, ?)", - ).run( - "default-scope", - "collision", - "Collision", - "{}", - JSON.stringify({ - api_key: { secretId: "sec-underscore" }, - "api-key": { secretId: "sec-dash" }, - }), - "{}", - ); + await db.exec(PRE_0007_SQL); + await stampPriorMigrationsApplied(db); + + await db + .prepare( + "INSERT INTO openapi_source (scope_id, id, name, spec, query_params, invocation_config) VALUES (?, ?, ?, ?, ?, ?)", + ) + .run( + "default-scope", + "collision", + "Collision", + "{}", + JSON.stringify({ + api_key: { secretId: "sec-underscore" }, + "api-key": { secretId: "sec-dash" }, + }), + "{}", + ); closeDatabase(db); - const sqlite = openDatabase(dbPath); - const drizzleDb = drizzle(sqlite); - expect(() => migrate(drizzleDb, { migrationsFolder: MIGRATIONS_FOLDER })).toThrow(); - closeDatabase(sqlite); + await expect(runMigrations(dbPath, MIGRATIONS_FOLDER)).rejects.toThrow(); }); - it("fails on punctuation collisions that runtime canonicalization would collapse", () => { + it("fails on punctuation collisions that runtime canonicalization would collapse", async () => { const db = openDatabase(dbPath); - db.exec(PRE_0007_SQL); - stampPriorMigrationsApplied(db); - - db.prepare( - "INSERT INTO openapi_source (scope_id, id, name, spec, query_params, invocation_config) VALUES (?, ?, ?, ?, ?, ?)", - ).run( - "default-scope", - "punctuation-collision", - "Punctuation Collision", - "{}", - JSON.stringify({ - "X@Token": { secretId: "sec-at" }, - "X-Token": { secretId: "sec-dash" }, - }), - "{}", - ); + await db.exec(PRE_0007_SQL); + await stampPriorMigrationsApplied(db); + + await db + .prepare( + "INSERT INTO openapi_source (scope_id, id, name, spec, query_params, invocation_config) VALUES (?, ?, ?, ?, ?, ?)", + ) + .run( + "default-scope", + "punctuation-collision", + "Punctuation Collision", + "{}", + JSON.stringify({ + "X@Token": { secretId: "sec-at" }, + "X-Token": { secretId: "sec-dash" }, + }), + "{}", + ); closeDatabase(db); - const sqlite = openDatabase(dbPath); - const drizzleDb = drizzle(sqlite); - expect(() => migrate(drizzleDb, { migrationsFolder: MIGRATIONS_FOLDER })).toThrow(); - closeDatabase(sqlite); + await expect(runMigrations(dbPath, MIGRATIONS_FOLDER)).rejects.toThrow(); }); - it("rewrites old OpenAPI header and OAuth JSON into slot config plus core bindings", () => { + it("rewrites old OpenAPI header and OAuth JSON into slot config plus core bindings", async () => { const db = openDatabase(dbPath); - db.exec(PRE_0007_SQL); - stampPriorMigrationsApplied(db); + await db.exec(PRE_0007_SQL); + await stampPriorMigrationsApplied(db); const headers = { Authorization: { secretId: "header-token", prefix: "Bearer " }, @@ -361,29 +355,28 @@ describe("0007_normalize_plugin_secret_refs (openapi)", () => { scopes: ["read"], }; - db.prepare( - "INSERT INTO openapi_source (scope_id, id, name, spec, headers, oauth2, invocation_config) VALUES (?, ?, ?, ?, ?, ?, ?)", - ).run( - "default-scope", - "src", - "Source", - "{}", - JSON.stringify(headers), - JSON.stringify(oauth2), - JSON.stringify({}), - ); + await db + .prepare( + "INSERT INTO openapi_source (scope_id, id, name, spec, headers, oauth2, invocation_config) VALUES (?, ?, ?, ?, ?, ?, ?)", + ) + .run( + "default-scope", + "src", + "Source", + "{}", + JSON.stringify(headers), + JSON.stringify(oauth2), + JSON.stringify({}), + ); closeDatabase(db); - const drizzleSqlite = openDatabase(dbPath); - const drizzleDb = drizzle(drizzleSqlite); - migrate(drizzleDb, { migrationsFolder: MIGRATIONS_FOLDER }); - closeDatabase(drizzleSqlite); + await runMigrations(dbPath, MIGRATIONS_FOLDER); - const after = openDatabase(dbPath, { readonly: true }); + const after = openDatabase(dbPath); const source = decodePluginStorageData( decodePluginStorageRow( - after + await after .prepare( "SELECT data FROM plugin_storage WHERE plugin_id = ? AND collection = ? AND key = ?", ) @@ -401,7 +394,7 @@ describe("0007_normalize_plugin_secret_refs (openapi)", () => { "X-Already": { kind: "binding", slot: "header:x-already" }, }); const oldHeaderTableCount = decodeCountRow( - after + await after .prepare( "SELECT count(*) as n FROM sqlite_master WHERE type = 'table' AND name = 'openapi_source_header'", ) @@ -421,7 +414,7 @@ describe("0007_normalize_plugin_secret_refs (openapi)", () => { expect(migratedOAuth2).not.toHaveProperty("clientIdSecretId"); const bindings = decodeBindingRows( - after + await after .prepare( "SELECT id, scope_id, plugin_id, source_id, source_scope_id, slot_key, kind, secret_id, connection_id, text_value FROM credential_binding WHERE source_id = ? ORDER BY slot_key", ) @@ -437,7 +430,7 @@ describe("0007_normalize_plugin_secret_refs (openapi)", () => { ]); const oldSourceTableCount = decodeCountRow( - after + await after .prepare( "SELECT count(*) as n FROM sqlite_master WHERE type = 'table' AND name = 'openapi_source'", ) @@ -446,26 +439,25 @@ describe("0007_normalize_plugin_secret_refs (openapi)", () => { expect(oldSourceTableCount.n).toBe(0); }); - it("survives empty / missing json on bindings and sources", () => { + it("survives empty / missing json on bindings and sources", async () => { const db = openDatabase(dbPath); - db.exec(PRE_0007_SQL); - stampPriorMigrationsApplied(db); + await db.exec(PRE_0007_SQL); + await stampPriorMigrationsApplied(db); // Source with empty invocation_config and no query_params. - db.prepare( - "INSERT INTO openapi_source (scope_id, id, name, spec, invocation_config) VALUES (?, ?, ?, ?, ?)", - ).run("default-scope", "bare", "Bare", "{}", JSON.stringify({})); + await db + .prepare( + "INSERT INTO openapi_source (scope_id, id, name, spec, invocation_config) VALUES (?, ?, ?, ?, ?)", + ) + .run("default-scope", "bare", "Bare", "{}", JSON.stringify({})); closeDatabase(db); - const drizzleSqlite = openDatabase(dbPath); - const drizzleDb = drizzle(drizzleSqlite); - migrate(drizzleDb, { migrationsFolder: MIGRATIONS_FOLDER }); - closeDatabase(drizzleSqlite); + await runMigrations(dbPath, MIGRATIONS_FOLDER); - const after = openDatabase(dbPath, { readonly: true }); + const after = openDatabase(dbPath); const source = decodePluginStorageData( decodePluginStorageRow( - after + await after .prepare( "SELECT data FROM plugin_storage WHERE plugin_id = ? AND collection = ? AND key = ?", ) diff --git a/apps/local/src/server/migration-nesting.test.ts b/apps/local/src/server/migration-nesting.test.ts index fad663c29..c8f2e07a5 100644 --- a/apps/local/src/server/migration-nesting.test.ts +++ b/apps/local/src/server/migration-nesting.test.ts @@ -1,12 +1,12 @@ // Lint: reject migration SQL that nests a single function call too deeply. // -// bun:sqlite's lemon parser stack overflows at PREPARE time when an -// expression nests too deep, and the limit is platform-dependent — the -// macOS-built compiled CLI binary trips around ~40 levels while Linux can -// go further. Our test matrix only runs on Linux today, so a regression -// won't surface in CI; this lint catches the class of bug structurally -// instead. Cap is 20 (well above any legitimate nested-function call we -// have today, well below the macOS bun:sqlite parser limit). +// SQLite's lemon parser stack overflows at PREPARE time when an expression +// nests too deep, and the limit is platform/build-dependent (historically the +// macOS-built compiled CLI tripped around ~40 levels). The runtime is now +// libSQL, which uses the same SQLite parser, so the structural risk persists; +// this lint catches the class of bug regardless of which build runs the +// migration. Cap is 20 (well above any legitimate nested-function call we have +// today, well below the SQLite parser limit). import { describe, expect, it } from "@effect/vitest"; import { readdirSync, readFileSync } from "node:fs"; import { join } from "node:path"; @@ -97,8 +97,7 @@ describe("drizzle migration SQL structural lint", () => { }; // The expectation is `summary.ok === true`. The full `summary` object is // matched (not just `.ok`) so the failure diff prints file/line/fn/depth - // — bun:sqlite's lemon parser stack overflows on the compiled macOS CLI - // binary around depth 40, and the project's test matrix is Linux-only, + // — SQLite's lemon parser stack overflows on deeply nested expressions, // so the diff is the breadcrumb that tells you which migration to // refactor (precompute into a temp table à la 0008's __slug_norm, or // split the expression into multiple shallow steps). diff --git a/apps/local/src/server/observability.ts b/apps/local/src/server/observability.ts index 0b85721e0..6c13257ae 100644 --- a/apps/local/src/server/observability.ts +++ b/apps/local/src/server/observability.ts @@ -1,33 +1,10 @@ // --------------------------------------------------------------------------- -// Local-app `ErrorCapture` — console implementation. -// -// Unlike the cloud app (Sentry-backed), the CLI just prints the squashed -// cause + pretty-printed structured cause to stderr and returns a short -// correlation id. Operators can grep for the id in their terminal -// scrollback when a user reports an opaque 500 traceId. +// Local-app `ErrorCapture` — the shared console implementation with a `local-` +// trace id prefix. Prints the squashed cause + pretty-printed structured cause +// to stderr and returns a short correlation id. Operators can grep for the id +// in their terminal scrollback when a user reports an opaque 500 traceId. // --------------------------------------------------------------------------- -import { Cause, Effect, Layer } from "effect"; +import { consoleErrorCapture } from "@executor-js/api/server"; -import { ErrorCapture } from "@executor-js/api"; - -const nextTraceId = () => - `local-${Date.now().toString(36)}-${Math.random().toString(36).slice(2, 8)}`; - -export const ErrorCaptureLive: Layer.Layer = Layer.succeed( - ErrorCapture, - ErrorCapture.of({ - captureException: (cause) => - Effect.sync(() => { - const traceId = nextTraceId(); - const squashed = Cause.squash(cause); - console.error( - `[executor ${traceId}]`, - // oxlint-disable-next-line executor/no-instanceof-error -- boundary: console logger preserves native Error stack output - squashed instanceof Error ? (squashed.stack ?? squashed) : squashed, - ); - console.error(`[executor ${traceId}] cause:`, Cause.pretty(cause)); - return traceId; - }), - }), -); +export const ErrorCaptureLive = consoleErrorCapture("local"); diff --git a/apps/local/src/server/sqlite-fumadb.ts b/apps/local/src/server/sqlite-fumadb.ts index 57fb99d1b..3a186e7ac 100644 --- a/apps/local/src/server/sqlite-fumadb.ts +++ b/apps/local/src/server/sqlite-fumadb.ts @@ -1,15 +1,18 @@ -import { Database } from "bun:sqlite"; -import { drizzle, type BunSQLiteDatabase } from "drizzle-orm/bun-sqlite"; -import { fumadb, type FumaDB } from "fumadb"; +import { type Client } from "@libsql/client"; +import { Layer } from "effect"; +import { drizzle, type LibSQLDatabase } from "drizzle-orm/libsql"; +import { type FumaDB } from "fumadb"; import { createDrizzleRuntimeSchemaFromTables, createDrizzleRuntimeSchemaSqlFromTables, - drizzleAdapter, } from "fumadb/adapters/drizzle"; -import { schema as fumaSchema, type RelationsMap } from "fumadb/schema"; +import { type schema as fumaSchema, type RelationsMap } from "fumadb/schema"; +import { createExecutorFumaDb, DbProvider, type ExecutorDbHandle } from "@executor-js/api/server"; import type { FumaDb, FumaTables } from "@executor-js/sdk"; +import { openLocalLibsql } from "./libsql"; + type SqliteFumaSchema = ReturnType< typeof fumaSchema> >; @@ -17,8 +20,8 @@ type SqliteFumaSchema = ReturnType< export interface SqliteFumaDb { readonly db: FumaDb>; readonly fuma: FumaDB[]>; - readonly drizzle: BunSQLiteDatabase>; - readonly sqlite: Database; + readonly drizzle: LibSQLDatabase>; + readonly client: Client; readonly close: () => Promise; } @@ -33,9 +36,10 @@ export const createSqliteFumaDb = async ( options: CreateSqliteFumaDbOptions, ): Promise> => { const version = options.version ?? "1.0.0"; - const sqlite = new Database(options.path, { create: true }); - sqlite.exec("PRAGMA foreign_keys = ON"); - sqlite.exec("PRAGMA journal_mode = WAL"); + // libSQL opens a connection (not a shared in-process handle), so the + // foreign_keys + WAL PRAGMAs are applied on this connection inside + // openLocalLibsql. + const client = await openLocalLibsql(options.path); const schema = createDrizzleRuntimeSchemaFromTables({ tables: options.tables, @@ -43,7 +47,7 @@ export const createSqliteFumaDb = async ( version, provider: "sqlite", }); - const drizzleDb = drizzle(sqlite, { schema }); + const drizzleDb = drizzle({ client, schema }); for (const statement of createDrizzleRuntimeSchemaSqlFromTables({ tables: options.tables, @@ -51,31 +55,35 @@ export const createSqliteFumaDb = async ( version, provider: "sqlite", })) { - sqlite.exec(statement); + await client.execute(statement); } - const latestSchema = fumaSchema({ - version, + const { db, fuma } = createExecutorFumaDb(drizzleDb, { tables: options.tables, - }); - const factory = fumadb({ namespace: options.namespace, - schemas: [latestSchema], + version, + provider: "sqlite", }); - const fuma = factory.client( - drizzleAdapter({ - db: drizzleDb, - provider: "sqlite", - }), - ); return { - db: fuma.orm(version), + db, fuma, drizzle: drizzleDb, - sqlite, + client, close: async () => { - sqlite.close(); + client.close(); }, }; }; + +// Shared DbProvider seam (P2a). Local builds its libSQL handle once at boot +// (driver-open + WAL PRAGMA + the SQL-loop schema bring-up above stay here) and +// then re-exposes it under the shared `DbProvider` tag. The handle's lifecycle +// is owned by the caller's acquireRelease, so this projection's `close` is a +// no-op to avoid double-closing the connection. +export const localDbProviderLayer = (handle: SqliteFumaDb): Layer.Layer => + Layer.succeed(DbProvider)({ + db: handle.db, + fuma: handle.fuma, + close: async () => {}, + } satisfies ExecutorDbHandle); diff --git a/apps/local/src/server/sqlite-import.test.ts b/apps/local/src/server/sqlite-import.test.ts index 0e00e6128..67fdcaa07 100644 --- a/apps/local/src/server/sqlite-import.test.ts +++ b/apps/local/src/server/sqlite-import.test.ts @@ -1,13 +1,13 @@ import { afterEach, beforeEach, describe, expect, it } from "@effect/vitest"; -import { Database } from "bun:sqlite"; +import { type Client } from "@libsql/client"; import { Schema } from "effect"; import { existsSync, mkdtempSync, readFileSync, rmSync } from "node:fs"; import { tmpdir } from "node:os"; import { join } from "node:path"; +import { collectTables } from "@executor-js/api/server"; import { boolColumn, - collectTables, dateColumn, definePlugin, jsonColumn, @@ -18,13 +18,14 @@ import { } from "@executor-js/sdk"; import { withQueryContext } from "fumadb/query"; +import { openTestClient, openTestDb } from "./__test-helpers__/libsql-test-db"; import { importLegacySqliteIfNeeded, readBundledDrizzleMigrationHashes } from "./executor"; import { importSqliteDataToFuma, readLegacySqliteScopeIds } from "./sqlite-import"; import { createSqliteFumaDb, type SqliteFumaDb } from "./sqlite-fumadb"; let workDir: string; let sqlite: SqliteFumaDb | null; -let heldReader: Database | null; +let heldReader: Client | null; beforeEach(() => { workDir = mkdtempSync(join(tmpdir(), "executor-sqlite-import-")); @@ -38,9 +39,9 @@ afterEach(async () => { rmSync(workDir, { recursive: true, force: true }); }); -const seedSqlite = (path: string) => { - const db = new Database(path); - db.exec(` +const seedSqlite = async (path: string) => { + const db = openTestDb(path); + await db.exec(` CREATE TABLE source ( id TEXT PRIMARY KEY NOT NULL, plugin_id TEXT NOT NULL, @@ -60,57 +61,59 @@ const seedSqlite = (path: string) => { PRIMARY KEY (namespace, key) ); `); - db.prepare( - `INSERT INTO source ( + await db + .prepare( + `INSERT INTO source ( id, plugin_id, kind, name, url, can_remove, can_refresh, can_edit, created_at, updated_at ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`, - ).run( - "src_1", - "plugin", - "remote", - "Imported", - null, - 1, - 0, - 1, - 1_700_000_000_000, - 1_700_000_001_000, - ); - db.prepare("INSERT INTO blob (namespace, key, value) VALUES (?, ?, ?)").run( - "scope_a/plugin", - "spec", - "{}", - ); + ) + .run( + "src_1", + "plugin", + "remote", + "Imported", + null, + 1, + 0, + 1, + 1_700_000_000_000, + 1_700_000_001_000, + ); + await db + .prepare("INSERT INTO blob (namespace, key, value) VALUES (?, ?, ?)") + .run("scope_a/plugin", "spec", "{}"); db.close(); }; -const seedDrizzleMigrationHistory = ( - db: Database, +const seedDrizzleMigrationHistory = async ( + db: ReturnType, hashes: ReadonlyArray = readBundledDrizzleMigrationHashes( join(import.meta.dirname, "../../drizzle"), ), ) => { - db.exec(` + await db.exec(` CREATE TABLE "__drizzle_migrations" ( id INTEGER PRIMARY KEY AUTOINCREMENT NOT NULL, hash text NOT NULL, created_at numeric ); `); - const insert = db.prepare(`INSERT INTO "__drizzle_migrations" (hash, created_at) VALUES (?, ?)`); + const insert = await db.prepare( + `INSERT INTO "__drizzle_migrations" (hash, created_at) VALUES (?, ?)`, + ); for (const hash of hashes) { - insert.run(hash, Date.now()); + await insert.run(hash, Date.now()); } }; -const seedMigratedSqlite = ( +const seedMigratedSqlite = async ( path: string, options?: { readonly migrationHashes?: ReadonlyArray; }, ) => { - const db = new Database(path); - db.exec(` + const db = openTestDb(path); + await db.exec(` CREATE TABLE source ( scope_id TEXT NOT NULL, id TEXT NOT NULL, @@ -132,29 +135,29 @@ const seedMigratedSqlite = ( PRIMARY KEY (namespace, key) ); `); - seedDrizzleMigrationHistory(db, options?.migrationHashes); - db.prepare( - `INSERT INTO source ( + await seedDrizzleMigrationHistory(db, options?.migrationHashes); + await db + .prepare( + `INSERT INTO source ( scope_id, id, plugin_id, kind, name, url, can_remove, can_refresh, can_edit, created_at, updated_at ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`, - ).run( - "scope_a", - "src_1", - "plugin", - "remote", - "Imported", - null, - 1, - 0, - 1, - 1_700_000_000_000, - 1_700_000_001_000, - ); - db.prepare("INSERT INTO blob (namespace, key, value) VALUES (?, ?, ?)").run( - "scope_a/plugin", - "spec", - "{}", - ); + ) + .run( + "scope_a", + "src_1", + "plugin", + "remote", + "Imported", + null, + 1, + 0, + 1, + 1_700_000_000_000, + 1_700_000_001_000, + ); + await db + .prepare("INSERT INTO blob (namespace, key, value) VALUES (?, ?, ?)") + .run("scope_a/plugin", "spec", "{}"); db.close(); }; @@ -197,7 +200,7 @@ describe("importSqliteDataToFuma", () => { it("imports current SQLite rows into FumaDB SQLite without replacing source files", async () => { const sqlitePath = join(workDir, "data.db"); const markerPath = join(workDir, "fumadb-sqlite-imported"); - seedSqlite(sqlitePath); + await seedSqlite(sqlitePath); const tables = collectTables([]); sqlite = await createSqliteFumaDb({ @@ -238,8 +241,8 @@ describe("importSqliteDataToFuma", () => { it("imports every existing legacy scope from the global local database", async () => { const sqlitePath = join(workDir, "data.db"); - const db = new Database(sqlitePath); - db.exec(` + const db = openTestDb(sqlitePath); + await db.exec(` CREATE TABLE source ( scope_id TEXT NOT NULL, id TEXT NOT NULL, @@ -255,12 +258,12 @@ describe("importSqliteDataToFuma", () => { PRIMARY KEY (scope_id, id) ); `); - const insert = db.prepare( + const insert = await db.prepare( `INSERT INTO source ( scope_id, id, plugin_id, kind, name, url, can_remove, can_refresh, can_edit, created_at, updated_at ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`, ); - insert.run( + await insert.run( "scope_a", "src_a", "plugin", @@ -273,7 +276,7 @@ describe("importSqliteDataToFuma", () => { 1_700_000_000_000, 1_700_000_001_000, ); - insert.run( + await insert.run( "scope_b", "src_b", "plugin", @@ -289,7 +292,7 @@ describe("importSqliteDataToFuma", () => { db.close(); const tables = collectTables([]); - const legacyScopeIds = readLegacySqliteScopeIds({ + const legacyScopeIds = await readLegacySqliteScopeIds({ sqlitePath, tables, scopeId: "scope_a", @@ -324,8 +327,8 @@ describe("importSqliteDataToFuma", () => { it("normalizes plugin table values when importing legacy SQLite rows", async () => { const sqlitePath = join(workDir, "data.db"); - const db = new Database(sqlitePath); - db.exec(` + const db = openTestDb(sqlitePath); + await db.exec(` CREATE TABLE legacy_shape ( scope_id TEXT NOT NULL, id TEXT NOT NULL, @@ -337,19 +340,21 @@ describe("importSqliteDataToFuma", () => { PRIMARY KEY (scope_id, id) ); `); - db.prepare( - `INSERT INTO legacy_shape ( + await db + .prepare( + `INSERT INTO legacy_shape ( scope_id, id, payload, enabled, retry_after_ms, discovered_at, note ) VALUES (?, ?, ?, ?, ?, ?, ?)`, - ).run( - "scope_a", - "shape_1", - JSON.stringify({ auth: { type: "oauth2" }, paths: ["/v1/items"] }), - 1, - "9007199254740993", - 1_700_000_000_000, - null, - ); + ) + .run( + "scope_a", + "shape_1", + JSON.stringify({ auth: { type: "oauth2" }, paths: ["/v1/items"] }), + 1, + "9007199254740993", + 1_700_000_000_000, + null, + ); db.close(); const tables = collectTables([legacyShapePlugin]); @@ -387,7 +392,7 @@ describe("importSqliteDataToFuma", () => { it("writes the import marker only after the replacement database is in place", async () => { const sqlitePath = join(workDir, "data.db"); const markerPath = join(workDir, "fumadb-sqlite-imported"); - seedMigratedSqlite(sqlitePath); + await seedMigratedSqlite(sqlitePath); const tables = collectTables([]); const result = await importLegacySqliteIfNeeded({ @@ -420,7 +425,7 @@ describe("importSqliteDataToFuma", () => { it("imports an existing legacy schema with divergent Drizzle migration history", async () => { const sqlitePath = join(workDir, "data.db"); const markerPath = join(workDir, "fumadb-sqlite-imported"); - seedMigratedSqlite(sqlitePath, { + await seedMigratedSqlite(sqlitePath, { migrationHashes: ["different-branch-migration", "newer-branch-migration"], }); @@ -455,15 +460,17 @@ describe("importSqliteDataToFuma", () => { it("imports a checkpointed legacy WAL database even when DELETE journal mode is busy", async () => { const sqlitePath = join(workDir, "data.db"); const markerPath = join(workDir, "fumadb-sqlite-imported"); - seedMigratedSqlite(sqlitePath); + await seedMigratedSqlite(sqlitePath); - const writer = new Database(sqlitePath); - writer.exec("PRAGMA journal_mode = WAL"); + const writer = openTestClient(sqlitePath); + await writer.execute("PRAGMA journal_mode = WAL"); writer.close(); - heldReader = new Database(sqlitePath, { readonly: true }); - heldReader.exec("BEGIN"); - heldReader.query("SELECT * FROM source").all(); + // Hold a concurrent read on a SEPARATE libSQL connection so the importer's + // WAL checkpoint must contend with an open reader (busy_timeout handling). + heldReader = openTestClient(sqlitePath); + await heldReader.execute("BEGIN"); + await heldReader.execute("SELECT * FROM source"); const tables = collectTables([]); const result = await importLegacySqliteIfNeeded({ @@ -495,10 +502,10 @@ describe("importSqliteDataToFuma", () => { it("imports newly-loaded plugin tables from the original backup after the first cutover", async () => { const sqlitePath = join(workDir, "data.db"); const markerPath = join(workDir, "fumadb-sqlite-imported"); - seedMigratedSqlite(sqlitePath); + await seedMigratedSqlite(sqlitePath); - const legacy = new Database(sqlitePath); - legacy.exec(` + const legacy = openTestDb(sqlitePath); + await legacy.exec(` CREATE TABLE late_item ( scope_id TEXT NOT NULL, id TEXT NOT NULL, @@ -552,7 +559,7 @@ describe("importSqliteDataToFuma", () => { it("marks newly-loaded empty plugin tables so startup does not retry backup imports", async () => { const sqlitePath = join(workDir, "data.db"); const markerPath = join(workDir, "fumadb-sqlite-imported"); - seedMigratedSqlite(sqlitePath); + await seedMigratedSqlite(sqlitePath); const firstResult = await importLegacySqliteIfNeeded({ storage: { diff --git a/apps/local/src/server/sqlite-import.ts b/apps/local/src/server/sqlite-import.ts index 71a071d0f..3f0dc0bd1 100644 --- a/apps/local/src/server/sqlite-import.ts +++ b/apps/local/src/server/sqlite-import.ts @@ -1,4 +1,4 @@ -import { Database } from "bun:sqlite"; +import { type Client } from "@libsql/client"; import { Data } from "effect"; import { existsSync } from "node:fs"; @@ -6,6 +6,8 @@ import { existsSync } from "node:fs"; import { type AnyColumn, type AnyTable, type FumaTables } from "@executor-js/sdk"; +import { openLegacyLibsql, queryFirst, queryRows } from "./libsql"; + type SqliteRow = Record; type ImportFumaDb = Readonly<{ @@ -37,32 +39,36 @@ export interface LocalSqliteImportResult { const quoteIdent = (value: string): string => `"${value.replaceAll('"', '""')}"`; const sqliteStringLiteral = (value: string): string => `'${value.replaceAll("'", "''")}'`; -const tableExists = (sqlite: Database, tableName: string): boolean => { - const row = sqlite - .query<{ name: string }, [string]>( - "SELECT name FROM sqlite_master WHERE type = 'table' AND name = ?", - ) - .get(tableName); - return row !== null; +const tableExists = async (client: Client, tableName: string): Promise => { + const row = await queryFirst( + client, + "SELECT name FROM sqlite_master WHERE type = 'table' AND name = ?", + [tableName], + ); + return row != null; }; -const sqliteColumnNames = (sqlite: Database, tableName: string): ReadonlySet => { - const rows = sqlite - .query<{ name: string }, []>(`PRAGMA table_info(${sqliteStringLiteral(tableName)})`) - .all(); +const sqliteColumnNames = async ( + client: Client, + tableName: string, +): Promise> => { + const rows = await queryRows<{ name: string }>( + client, + `PRAGMA table_info(${sqliteStringLiteral(tableName)})`, + ); return new Set(rows.map((row) => row.name)); }; -const readRows = (sqlite: Database, tableName: string): readonly SqliteRow[] => - sqlite.query(`SELECT * FROM ${quoteIdent(tableName)}`).all(); +const readRows = async (client: Client, tableName: string): Promise => + queryRows(client, `SELECT * FROM ${quoteIdent(tableName)}`); -const readScopeIds = (sqlite: Database, tableName: string): readonly string[] => - sqlite - .query<{ scope_id: unknown }, []>( +const readScopeIds = async (client: Client, tableName: string): Promise => + ( + await queryRows<{ scope_id: unknown }>( + client, `SELECT DISTINCT "scope_id" AS scope_id FROM ${quoteIdent(tableName)} WHERE "scope_id" IS NOT NULL`, ) - .all() - .flatMap((row) => (typeof row.scope_id === "string" ? [row.scope_id] : [])); + ).flatMap((row) => (typeof row.scope_id === "string" ? [row.scope_id] : [])); const parseJson = (value: string): unknown => { try { @@ -160,23 +166,23 @@ const toFumaRow = (input: { return out; }; -export const readLegacySqliteScopeIds = (options: { +export const readLegacySqliteScopeIds = async (options: { readonly sqlitePath: string; readonly tables: FumaTables; readonly scopeId: string; -}): ReadonlySet => { +}): Promise> => { const scopeIds = new Set([options.scopeId]); if (!existsSync(options.sqlitePath)) return scopeIds; - let sqlite: Database | null = null; + let client: Client | null = null; try { - sqlite = new Database(options.sqlitePath, { readonly: true }); + client = openLegacyLibsql(options.sqlitePath); for (const table of Object.values(options.tables)) { const tableName = table.names.sql; - if (!tableExists(sqlite, tableName)) continue; - const columns = sqliteColumnNames(sqlite, tableName); + if (!(await tableExists(client, tableName))) continue; + const columns = await sqliteColumnNames(client, tableName); if (!columns.has("scope_id")) continue; - for (const scopeId of readScopeIds(sqlite, tableName)) { + for (const scopeId of await readScopeIds(client, tableName)) { scopeIds.add(scopeId); } } @@ -188,7 +194,7 @@ export const readLegacySqliteScopeIds = (options: { cause, }); } finally { - sqlite?.close(); + client?.close(); } }; @@ -199,20 +205,21 @@ export const importSqliteDataToFuma = async ( return { imported: false, importedRows: 0, importedTables: [] }; } - let sqlite: Database | null = null; + let client: Client | null = null; try { - sqlite = new Database(options.sqlitePath, { readonly: true }); + client = openLegacyLibsql(options.sqlitePath); + const reader = client; const importedTables: string[] = []; let importedRows = 0; await options.target.transaction(async (db) => { for (const [tableKey, table] of Object.entries(options.tables)) { const tableName = table.names.sql; - if (!tableExists(sqlite!, tableName)) continue; + if (!(await tableExists(reader, tableName))) continue; - const sqliteColumns = sqliteColumnNames(sqlite!, tableName); - const rows = readRows(sqlite!, tableName).map((row) => + const sqliteColumns = await sqliteColumnNames(reader, tableName); + const rows = (await readRows(reader, tableName)).map((row) => toFumaRow({ tableKey, table, @@ -229,8 +236,8 @@ export const importSqliteDataToFuma = async ( } }); - sqlite.close(); - sqlite = null; + client.close(); + client = null; return { imported: true, importedRows, importedTables }; } catch (cause) { @@ -240,6 +247,6 @@ export const importSqliteDataToFuma = async ( cause, }); } finally { - sqlite?.close(); + client?.close(); } }; diff --git a/bun.lock b/bun.lock index 7adc2b1b7..2672ced5e 100644 --- a/bun.lock +++ b/bun.lock @@ -151,6 +151,50 @@ "vite": "catalog:", }, }, + "apps/host-selfhost": { + "name": "@executor-js/host-selfhost", + "version": "0.0.0", + "dependencies": { + "@better-auth/api-key": "^1.6.11", + "@effect/atom-react": "catalog:", + "@effect/platform-bun": "catalog:", + "@executor-js/api": "workspace:*", + "@executor-js/app": "workspace:*", + "@executor-js/execution": "workspace:*", + "@executor-js/host-mcp": "workspace:*", + "@executor-js/plugin-encrypted-secrets": "workspace:*", + "@executor-js/plugin-graphql": "workspace:*", + "@executor-js/plugin-mcp": "workspace:*", + "@executor-js/plugin-openapi": "workspace:*", + "@executor-js/react": "workspace:*", + "@executor-js/runtime-quickjs": "workspace:*", + "@executor-js/sdk": "workspace:*", + "@libsql/client": "catalog:", + "@libsql/kysely-libsql": "catalog:", + "@modelcontextprotocol/sdk": "^1.29.0", + "@tanstack/react-router": "catalog:", + "better-auth": "^1.6.11", + "drizzle-orm": "catalog:", + "effect": "catalog:", + "fumadb": "workspace:*", + "react": "catalog:", + "react-dom": "catalog:", + }, + "devDependencies": { + "@effect/vitest": "catalog:", + "@executor-js/vite-plugin": "workspace:*", + "@tailwindcss/vite": "catalog:", + "@tanstack/router-plugin": "^1.167.12", + "@types/node": "catalog:", + "@types/react": "catalog:", + "@types/react-dom": "catalog:", + "@vitejs/plugin-react": "catalog:", + "bun-types": "catalog:", + "typescript": "catalog:", + "vite": "catalog:", + "vitest": "catalog:", + }, + }, "apps/local": { "name": "@executor-js/local", "version": "1.4.4", @@ -175,6 +219,7 @@ "@executor-js/runtime-quickjs": "workspace:*", "@executor-js/sdk": "workspace:*", "@executor-js/vite-plugin": "workspace:*", + "@libsql/client": "catalog:", "@modelcontextprotocol/sdk": "^1.12.1", "@tanstack/react-router": "catalog:", "drizzle-orm": "catalog:", @@ -301,6 +346,7 @@ "version": "1.4.21", "dependencies": { "@executor-js/execution": "workspace:*", + "@executor-js/host-mcp": "workspace:*", "@executor-js/sdk": "workspace:*", "effect": "catalog:", }, @@ -427,10 +473,9 @@ "@effect/atom-react": "catalog:", "@effect/platform-node": "catalog:", "@effect/vitest": "catalog:", - "@types/better-sqlite3": "^7.6.13", + "@libsql/client": "catalog:", "@types/node": "catalog:", "@types/react": "catalog:", - "better-sqlite3": "^12.9.0", "drizzle-orm": "catalog:", "react": "catalog:", "tsup": "catalog:", @@ -603,6 +648,21 @@ "typescript": "catalog:", }, }, + "packages/plugins/encrypted-secrets": { + "name": "@executor-js/plugin-encrypted-secrets", + "version": "0.0.0", + "dependencies": { + "@executor-js/sdk": "workspace:*", + "effect": "catalog:", + }, + "devDependencies": { + "@effect/vitest": "catalog:", + "@types/node": "catalog:", + "bun-types": "catalog:", + "tsup": "catalog:", + "vitest": "catalog:", + }, + }, "packages/plugins/example": { "name": "@executor-js/plugin-example", "version": "1.4.33", @@ -884,6 +944,8 @@ "@effect/platform-node": "4.0.0-beta.59", "@effect/vitest": "4.0.0-beta.59", "@jitl/quickjs-wasmfile-release-sync": "0.31.0", + "@libsql/client": "^0.17.3", + "@libsql/kysely-libsql": "^0.4.1", "@tailwindcss/vite": "^4.2.2", "@tanstack/react-router": "^1.168.10", "@tanstack/react-start": "^1.167.16", @@ -1054,6 +1116,26 @@ "@base-ui/utils": ["@base-ui/utils@0.2.7", "", { "dependencies": { "@babel/runtime": "^7.29.2", "@floating-ui/utils": "^0.2.11", "reselect": "^5.1.1", "use-sync-external-store": "^1.6.0" }, "peerDependencies": { "@types/react": "^17 || ^18 || ^19", "react": "^17 || ^18 || ^19", "react-dom": "^17 || ^18 || ^19" }, "optionalPeers": ["@types/react"] }, "sha512-nXYKhiL/0JafyJE8PfcflipGftOftlIwKd72rU15iZ1M5yqgg5J9P8NHU71GReDuXco5MJA/eVQqUT5WRqX9sA=="], + "@better-auth/api-key": ["@better-auth/api-key@1.6.12", "", { "dependencies": { "zod": "^4.3.6" }, "peerDependencies": { "@better-auth/core": "^1.6.12", "@better-auth/utils": "0.4.1", "better-auth": "^1.6.12", "better-call": "1.3.5" } }, "sha512-LTM90m9vWvSwSCdlXKe250jU2OUww1WTBazEOHmafPj+NDNwXX21TwDxkUIY+FAhgRCw/81Tzuki4auZmeZctw=="], + + "@better-auth/core": ["@better-auth/core@1.6.12", "", { "dependencies": { "@opentelemetry/semantic-conventions": "^1.39.0", "@standard-schema/spec": "^1.1.0", "zod": "^4.3.6" }, "peerDependencies": { "@better-auth/utils": "0.4.1", "@better-fetch/fetch": "1.1.21", "@cloudflare/workers-types": ">=4", "@opentelemetry/api": "^1.9.0", "better-call": "1.3.5", "jose": "^6.1.0", "kysely": "^0.28.5 || ^0.29.0", "nanostores": "^1.0.1" }, "optionalPeers": ["@cloudflare/workers-types", "@opentelemetry/api"] }, "sha512-6mXtYSYfo6TvHHCZAZmfjvIQQtBDWzWzwy9iIWPEoede2lP2SuJzkfIQNuTtIGzZcn7a9iuzIm1jWDBzfnBARg=="], + + "@better-auth/drizzle-adapter": ["@better-auth/drizzle-adapter@1.6.12", "", { "peerDependencies": { "@better-auth/core": "^1.6.12", "@better-auth/utils": "0.4.1", "drizzle-orm": "^0.45.2" }, "optionalPeers": ["drizzle-orm"] }, "sha512-g0sKQstvXHH70s+TjAXo86cNyWV60ahhJm1sow27RyW41U10vfBehOFinU3GPESyxl/fEr9D27rk3jdl6E3l3A=="], + + "@better-auth/kysely-adapter": ["@better-auth/kysely-adapter@1.6.12", "", { "peerDependencies": { "@better-auth/core": "^1.6.12", "@better-auth/utils": "0.4.1", "kysely": "^0.28.17 || ^0.29.0" }, "optionalPeers": ["kysely"] }, "sha512-KhPwPmLj+MoTVGV6goPfCYf/7Fuiy2Q37GEWhvQdoFjkYKbGo995OoghBVNBnAYOakYvTYjG0JebCfiETBVX3g=="], + + "@better-auth/memory-adapter": ["@better-auth/memory-adapter@1.6.12", "", { "peerDependencies": { "@better-auth/core": "^1.6.12", "@better-auth/utils": "0.4.1" } }, "sha512-flblsePBCcB0DA6hewAOupxyypNTQczZvkNYvRrsVlBDIh0+vHBU/dTjoDmuQnZ3egTdFNnMeC+VrNnqt/GFUg=="], + + "@better-auth/mongo-adapter": ["@better-auth/mongo-adapter@1.6.12", "", { "peerDependencies": { "@better-auth/core": "^1.6.12", "@better-auth/utils": "0.4.1", "mongodb": "^6.0.0 || ^7.0.0" }, "optionalPeers": ["mongodb"] }, "sha512-IeiHZN9PtIyiqYgTDlrmm8sYI++5p1OI49uWB7LHg2+touiaNUGe0uWYymQpw1zq1e8FJxKlwvOc5vw6nGrI6g=="], + + "@better-auth/prisma-adapter": ["@better-auth/prisma-adapter@1.6.12", "", { "peerDependencies": { "@better-auth/core": "^1.6.12", "@better-auth/utils": "0.4.1", "@prisma/client": "^5.0.0 || ^6.0.0 || ^7.0.0", "prisma": "^5.0.0 || ^6.0.0 || ^7.0.0" }, "optionalPeers": ["@prisma/client", "prisma"] }, "sha512-+GvU8vZ3aJUHDBuR5PxtU5OpPQS2T9ND7s2JYm63bD6rnYztLwEo8bwHL3BvsTwSvCjFHZCtsn1A+6qyoOzTMw=="], + + "@better-auth/telemetry": ["@better-auth/telemetry@1.6.12", "", { "peerDependencies": { "@better-auth/core": "^1.6.12", "@better-auth/utils": "0.4.1", "@better-fetch/fetch": "1.1.21" } }, "sha512-g59qLPq9SROyku0X5tiZpXXiVrsbjB1QA6OctOt9svzj7NjCFBoCAO9QlBiOTUolo0l9CF6fLlc85PoBkY5RtA=="], + + "@better-auth/utils": ["@better-auth/utils@0.4.1", "", { "dependencies": { "@noble/hashes": "^2.0.1" } }, "sha512-SZBPRPF3z0nBvE5ygOkxae35wnnXPRShmqFo78S+qslLeFoPu/pMgnXAuNKFMMybac3tiLaVg1e3MQW5MC+1iA=="], + + "@better-fetch/fetch": ["@better-fetch/fetch@1.1.21", "", {}, "sha512-/ImESw0sskqlVR94jB+5+Pxjf+xBwDZF/N5+y2/q4EqD7IARUTSpPfIo8uf39SYpCxyOCtbyYpUrZ3F/k0zT4A=="], + "@braintree/sanitize-url": ["@braintree/sanitize-url@7.1.2", "", {}, "sha512-jigsZK+sMF/cuiB7sERuo9V7N9jx+dhmHHnQyDSVdpZwVutaBu7WvNYqMDLSgFgfB30n452TP3vjDAvFC973mA=="], "@capsizecss/unpack": ["@capsizecss/unpack@4.0.0", "", { "dependencies": { "fontkitten": "^1.0.0" } }, "sha512-VERIM64vtTP1C4mxQ5thVT9fK0apjPFobqybMtA1UdUujWka24ERHbRHFGmpbbhp73MhV+KSsHQH9C6uOTdEQA=="], @@ -1318,6 +1400,8 @@ "@executor-js/host-mcp": ["@executor-js/host-mcp@workspace:packages/hosts/mcp"], + "@executor-js/host-selfhost": ["@executor-js/host-selfhost@workspace:apps/host-selfhost"], + "@executor-js/integrations-registry": ["@executor-js/integrations-registry@workspace:packages/core/integrations-registry"], "@executor-js/ir": ["@executor-js/ir@workspace:packages/kernel/ir"], @@ -1328,6 +1412,8 @@ "@executor-js/plugin-desktop-settings": ["@executor-js/plugin-desktop-settings@workspace:packages/plugins/desktop-settings"], + "@executor-js/plugin-encrypted-secrets": ["@executor-js/plugin-encrypted-secrets@workspace:packages/plugins/encrypted-secrets"], + "@executor-js/plugin-example": ["@executor-js/plugin-example@workspace:packages/plugins/example"], "@executor-js/plugin-file-secrets": ["@executor-js/plugin-file-secrets@workspace:packages/plugins/file-secrets"], @@ -1506,6 +1592,36 @@ "@jsdevtools/ono": ["@jsdevtools/ono@7.1.3", "", {}, "sha512-4JQNk+3mVzK3xh2rqd6RB4J46qUR19azEHBneZyTZM+c456qOrbbM/5xcR8huNCCcbVt7+UmizG6GuUvPvKUYg=="], + "@libsql/client": ["@libsql/client@0.17.3", "", { "dependencies": { "@libsql/core": "^0.17.3", "@libsql/hrana-client": "^0.10.0", "js-base64": "^3.7.5", "libsql": "^0.5.28", "promise-limit": "^2.7.0" } }, "sha512-HXk9wiAoJbKFbyBH4O+aEhN6ir5ERXuXvwE5OD2eR4/5RUa3Pw/8L9zrnVdU+iNJitRvisPWaIwmhkO3bH7giA=="], + + "@libsql/core": ["@libsql/core@0.17.3", "", { "dependencies": { "js-base64": "^3.7.5" } }, "sha512-2UjK1i7JBkMduJo4WdvvBxMMvVJ31pArBZNONyz/GCJJAH+1UHat2X6vn10S/WpY5fKzIT98WqYFl2vzWRLOfg=="], + + "@libsql/darwin-arm64": ["@libsql/darwin-arm64@0.5.29", "", { "os": "darwin", "cpu": "arm64" }, "sha512-K+2RIB1OGFPYQbfay48GakLhqf3ArcbHqPFu7EZiaUcRgFcdw8RoltsMyvbj5ix2fY0HV3Q3Ioa/ByvQdaSM0A=="], + + "@libsql/darwin-x64": ["@libsql/darwin-x64@0.5.29", "", { "os": "darwin", "cpu": "x64" }, "sha512-OtT+KFHsKFy1R5FVadr8FJ2Bb1mghtXTyJkxv0trocq7NuHntSki1eUbxpO5ezJesDvBlqFjnWaYYY516QNLhQ=="], + + "@libsql/hrana-client": ["@libsql/hrana-client@0.10.0", "", { "dependencies": { "@libsql/isomorphic-ws": "^0.1.5", "js-base64": "^3.7.5" } }, "sha512-OoA4EMqRAC7kn7V2P6EQqRcpZf2W+AjsNIyCizBg339Tq/aMC7sRnzs3SklderhmQWAqEzvv8A2vhxVmWpkVvw=="], + + "@libsql/isomorphic-fetch": ["@libsql/isomorphic-fetch@0.2.5", "", {}, "sha512-8s/B2TClEHms2yb+JGpsVRTPBfy1ih/Pq6h6gvyaNcYnMVJvgQRY7wAa8U2nD0dppbCuDU5evTNMEhrQ17ZKKg=="], + + "@libsql/isomorphic-ws": ["@libsql/isomorphic-ws@0.1.5", "", { "dependencies": { "@types/ws": "^8.5.4", "ws": "^8.13.0" } }, "sha512-DtLWIH29onUYR00i0GlQ3UdcTRC6EP4u9w/h9LxpUZJWRMARk6dQwZ6Jkd+QdwVpuAOrdxt18v0K2uIYR3fwFg=="], + + "@libsql/kysely-libsql": ["@libsql/kysely-libsql@0.4.1", "", { "dependencies": { "@libsql/client": "^0.8.0" }, "peerDependencies": { "kysely": "*" } }, "sha512-mCTa6OWgoME8LNu22COM6XjKBmcMAvNtIO6DYM10jSAFq779fVlrTKQEmXIB8TwJVU65dA5jGCpT8gkDdWS0HQ=="], + + "@libsql/linux-arm-gnueabihf": ["@libsql/linux-arm-gnueabihf@0.5.29", "", { "os": "linux", "cpu": "arm" }, "sha512-CD4n4zj7SJTHso4nf5cuMoWoMSS7asn5hHygsDuhRl8jjjCTT3yE+xdUvI4J7zsyb53VO5ISh4cwwOtf6k2UhQ=="], + + "@libsql/linux-arm-musleabihf": ["@libsql/linux-arm-musleabihf@0.5.29", "", { "os": "linux", "cpu": "arm" }, "sha512-2Z9qBVpEJV7OeflzIR3+l5yAd4uTOLxklScYTwpZnkm2vDSGlC1PRlueLaufc4EFITkLKXK2MWBpexuNJfMVcg=="], + + "@libsql/linux-arm64-gnu": ["@libsql/linux-arm64-gnu@0.5.29", "", { "os": "linux", "cpu": "arm64" }, "sha512-gURBqaiXIGGwFNEaUj8Ldk7Hps4STtG+31aEidCk5evMMdtsdfL3HPCpvys+ZF/tkOs2MWlRWoSq7SOuCE9k3w=="], + + "@libsql/linux-arm64-musl": ["@libsql/linux-arm64-musl@0.5.29", "", { "os": "linux", "cpu": "arm64" }, "sha512-fwgYZ0H8mUkyVqXZHF3mT/92iIh1N94Owi/f66cPVNsk9BdGKq5gVpoKO+7UxaNzuEH1roJp2QEwsCZMvBLpqg=="], + + "@libsql/linux-x64-gnu": ["@libsql/linux-x64-gnu@0.5.29", "", { "os": "linux", "cpu": "x64" }, "sha512-y14V0vY0nmMC6G0pHeJcEarcnGU2H6cm21ZceRkacWHvQAEhAG0latQkCtoS2njFOXiYIg+JYPfAoWKbi82rkg=="], + + "@libsql/linux-x64-musl": ["@libsql/linux-x64-musl@0.5.29", "", { "os": "linux", "cpu": "x64" }, "sha512-gquqwA/39tH4pFl+J9n3SOMSymjX+6kZ3kWgY3b94nXFTwac9bnFNMffIomgvlFaC4ArVqMnOZD3nuJ3H3VO1w=="], + + "@libsql/win32-x64-msvc": ["@libsql/win32-x64-msvc@0.5.29", "", { "os": "win32", "cpu": "x64" }, "sha512-4/0CvEdhi6+KjMxMaVbFM2n2Z44escBRoEYpR+gZg64DdetzGnYm8mcNLcoySaDJZNaBd6wz5DNdgRmcI4hXcg=="], + "@lit-labs/ssr-dom-shim": ["@lit-labs/ssr-dom-shim@1.5.1", "", {}, "sha512-Aou5UdlSpr5whQe8AA/bZG0jMj96CoJIWbGfZ91qieWu5AWUMKw8VR/pAkQkJYvBNhmCcWnZlyyk5oze8JIqYA=="], "@lit/reactive-element": ["@lit/reactive-element@2.1.2", "", { "dependencies": { "@lit-labs/ssr-dom-shim": "^1.5.0" } }, "sha512-pbCDiVMnne1lYUIaYNN5wrwQXDtHaYtg7YEFPeW+hws6U47WeFvISGUWekPGKWOP1ygrs0ef0o1VJMk1exos5A=="], @@ -1576,6 +1692,10 @@ "@napi-rs/wasm-runtime": ["@napi-rs/wasm-runtime@1.1.4", "", { "dependencies": { "@tybys/wasm-util": "^0.10.1" }, "peerDependencies": { "@emnapi/core": "^1.7.1", "@emnapi/runtime": "^1.7.1" } }, "sha512-3NQNNgA1YSlJb/kMH1ildASP9HW7/7kYnRI2szWJaofaS1hWmbGI4H+d3+22aGzXXN9IJ+n+GiFVcGipJP18ow=="], + "@neon-rs/load": ["@neon-rs/load@0.0.4", "", {}, "sha512-kTPhdZyTQxB+2wpiRcFWrDcejc4JI6tkPuS7UZCG4l6Zvc5kU/gGQ/ozvHTh1XR5tS+UlfAfGuPajjzQjCiHCw=="], + + "@noble/ciphers": ["@noble/ciphers@2.2.0", "", {}, "sha512-Z6pjIZ/8IJcCGzb2S/0Px5J81yij85xASuk1teLNeg75bfT07MV3a/O2Mtn1I2se43k3lkVEcFaR10N4cgQcZA=="], + "@noble/hashes": ["@noble/hashes@2.2.0", "", {}, "sha512-IYqDGiTXab6FniAgnSdZwgWbomxpy9FtYvLKs7wCUs2a8RkITG+DFGO1DM9cr+E3/RgADRpFjrKVaJ1z6sjtEg=="], "@nodelib/fs.scandir": ["@nodelib/fs.scandir@2.1.5", "", { "dependencies": { "@nodelib/fs.stat": "2.0.5", "run-parallel": "^1.1.9" } }, "sha512-vq24Bq3ym5HEQm2NKCr3yXDwjc7vTsEThRDnkp2DK9p1uqLR+DHurm/NOTo0KG7HYHU7eppKZj3MyqYuMBf62g=="], @@ -2574,6 +2694,10 @@ "baseline-browser-mapping": ["baseline-browser-mapping@2.10.19", "", { "bin": { "baseline-browser-mapping": "dist/cli.cjs" } }, "sha512-qCkNLi2sfBOn8XhZQ0FXsT1Ki/Yo5P90hrkRamVFRS7/KV9hpfA4HkoWNU152+8w0zPjnxo5psx5NL3PSGgv5g=="], + "better-auth": ["better-auth@1.6.12", "", { "dependencies": { "@better-auth/core": "1.6.12", "@better-auth/drizzle-adapter": "1.6.12", "@better-auth/kysely-adapter": "1.6.12", "@better-auth/memory-adapter": "1.6.12", "@better-auth/mongo-adapter": "1.6.12", "@better-auth/prisma-adapter": "1.6.12", "@better-auth/telemetry": "1.6.12", "@better-auth/utils": "0.4.1", "@better-fetch/fetch": "1.1.21", "@noble/ciphers": "^2.1.1", "@noble/hashes": "^2.0.1", "better-call": "1.3.5", "defu": "^6.1.4", "jose": "^6.1.3", "kysely": "^0.28.17 || ^0.29.0", "nanostores": "^1.1.1", "zod": "^4.3.6" }, "peerDependencies": { "@lynx-js/react": "*", "@prisma/client": "^5.0.0 || ^6.0.0 || ^7.0.0", "@sveltejs/kit": "^2.0.0", "@tanstack/react-start": "^1.0.0", "@tanstack/solid-start": "^1.0.0", "better-sqlite3": "^12.0.0", "drizzle-kit": ">=0.31.4", "drizzle-orm": "^0.45.2", "mongodb": "^6.0.0 || ^7.0.0", "mysql2": "^3.0.0", "next": "^14.0.0 || ^15.0.0 || ^16.0.0", "pg": "^8.0.0", "prisma": "^5.0.0 || ^6.0.0 || ^7.0.0", "react": "^18.0.0 || ^19.0.0", "react-dom": "^18.0.0 || ^19.0.0", "solid-js": "^1.0.0", "svelte": "^4.0.0 || ^5.0.0", "vitest": "^2.0.0 || ^3.0.0 || ^4.0.0", "vue": "^3.0.0" }, "optionalPeers": ["@lynx-js/react", "@prisma/client", "@sveltejs/kit", "@tanstack/react-start", "@tanstack/solid-start", "better-sqlite3", "drizzle-kit", "drizzle-orm", "mongodb", "mysql2", "next", "pg", "prisma", "react", "react-dom", "solid-js", "svelte", "vitest", "vue"] }, "sha512-vJG8hB+zcayZEJgcWGTzP2XODZuf/WKViOtam+uhhQ9879yc7fDWAV9O4jSs+R28noSXIAaB3zhIMN3DaDO3cA=="], + + "better-call": ["better-call@1.3.5", "", { "dependencies": { "@better-auth/utils": "^0.4.0", "@better-fetch/fetch": "^1.1.21", "rou3": "^0.7.12", "set-cookie-parser": "^3.0.1" }, "peerDependencies": { "zod": "^4.0.0" }, "optionalPeers": ["zod"] }, "sha512-kOFJkBP7utAQLEYrobZm3vkTH8mXq5GNgvjc5/XEST1ilVHaxXUXfeDeFlqoETMtyqS4+3/h4ONX2i++ebZrvA=="], + "better-path-resolve": ["better-path-resolve@1.0.0", "", { "dependencies": { "is-windows": "^1.0.0" } }, "sha512-pbnl5XzGBdrFU/wT4jqmJVPn2B6UHPBOhzMQkY/SPUPB6QtUXtmBHBIwCbXJol93mOpGMnQyP/+BB19q04xj7g=="], "better-sqlite3": ["better-sqlite3@12.10.0", "", { "dependencies": { "bindings": "^1.5.0", "prebuild-install": "^7.1.1" } }, "sha512-CyzaZRQKyHkB2ZInfTTl2nvT33EbDpjkLEbE8/Zck3Ll6O0qqvuGdrJ45HgtH+HykRg88ITY3AdreBGN70aBSQ=="], @@ -2858,6 +2982,8 @@ "dagre-d3-es": ["dagre-d3-es@7.0.14", "", { "dependencies": { "d3": "^7.9.0", "lodash-es": "^4.17.21" } }, "sha512-P4rFMVq9ESWqmOgK+dlXvOtLwYg0i7u0HBGJER0LZDJT2VHIPAMZ/riPxqJceWMStH5+E61QxFra9kIS3AqdMg=="], + "data-uri-to-buffer": ["data-uri-to-buffer@4.0.1", "", {}, "sha512-0R9ikRb668HB7QDxT1vkpuUBtqc53YyAwMwGeUFKRojY/NWKvdZ+9UYtRfGmhqNbRkTSVpMbmyhXipFFv2cb/A=="], + "date-fns": ["date-fns@4.1.0", "", {}, "sha512-Ukq0owbQXxa/U3EGtsdVBkR1w7KOQ5gIBqdH2hkvknzZPYvBxb/aa6E8L7tmjFtkwZBu3UXBbjIgPo/Ez4xaNg=="], "date-fns-jalali": ["date-fns-jalali@4.1.0-0", "", {}, "sha512-hTIP/z+t+qKwBDcmmsnmjWTduxCg+5KfdqWQvb2X/8C9+knYY6epN/pfxdDuyVlSVeFz0sM5eEfwIUQ70U4ckg=="], @@ -3126,6 +3252,8 @@ "fdir": ["fdir@6.5.0", "", { "peerDependencies": { "picomatch": "^3 || ^4" }, "optionalPeers": ["picomatch"] }, "sha512-tIbYtZbucOs0BRGqPJkshJUYdL+SDH7dVM8gjy+ERp3WAUjLEFJE+02kanyHtwjWOnwrKYBiwAmM0p4kLJAnXg=="], + "fetch-blob": ["fetch-blob@3.2.0", "", { "dependencies": { "node-domexception": "^1.0.0", "web-streams-polyfill": "^3.0.3" } }, "sha512-7yAQpD2UMJzLi1Dqv7qFYnPbaPx7ZfFK6PiIxQ4PfkGPyNyl2Ugx+a/umUonmKqjhM4DnfbMvdX6otXq83soQQ=="], + "fflate": ["fflate@0.4.8", "", {}, "sha512-FJqqoDBR00Mdj9ppamLa/Y7vxm+PRmNWA67N846RvsoYVMKB4q3y/de5PA7gUmRMYK/8CMz2GDZQmCRN1wBcWA=="], "figures": ["figures@6.1.0", "", { "dependencies": { "is-unicode-supported": "^2.0.0" } }, "sha512-d+l3qxjSesT4V7v2fh+QnmFnUWv9lSpjarhShNTgBOfA0ttejbQUAlHLitbjkoRiDulW0OPoQPYIGhIC8ohejg=="], @@ -3168,6 +3296,8 @@ "formatly": ["formatly@0.3.0", "", { "dependencies": { "fd-package-json": "^2.0.0" }, "bin": { "formatly": "bin/index.mjs" } }, "sha512-9XNj/o4wrRFyhSMJOvsuyMwy8aUfBaZ1VrqHVfohyXf0Sw0e+yfKG+xZaY3arGCOMdwFsqObtzVOc1gU9KiT9w=="], + "formdata-polyfill": ["formdata-polyfill@4.0.10", "", { "dependencies": { "fetch-blob": "^3.1.2" } }, "sha512-buewHzMvYL29jdeQTVILecSaZKnt/RJWjoZCF5OW60Z67/GmSLBkOFM7qh1PI3zFNtJbaZL5eQu1vLfazOwj4g=="], + "forwarded": ["forwarded@0.2.0", "", {}, "sha512-buRG0fpBtRHSTCOASe6hD258tEubFoRLb4ZNA6NxMVHNw2gOcwHo9wyablzMzOA5z9xA9L1KNjk/Nt6MT9aYow=="], "fractional-indexing": ["fractional-indexing@3.2.0", "", {}, "sha512-PcOxmqwYCW7O2ovKRU8OoQQj2yqTfEB/yeTYk4gPid6dN5ODRfU1hXd9tTVZzax/0NkO7AxpHykvZnT1aYp/BQ=="], @@ -3514,6 +3644,8 @@ "leva": ["leva@0.10.1", "", { "dependencies": { "@radix-ui/react-portal": "^1.1.4", "@radix-ui/react-tooltip": "^1.1.8", "@stitches/react": "^1.2.8", "@use-gesture/react": "^10.2.5", "colord": "^2.9.2", "dequal": "^2.0.2", "merge-value": "^1.0.0", "react-colorful": "^5.5.1", "react-dropzone": "^12.0.0", "v8n": "^1.3.3", "zustand": "^3.6.9" }, "peerDependencies": { "react": "^18.0.0 || ^19.0.0", "react-dom": "^18.0.0 || ^19.0.0" } }, "sha512-BcjnfUX8jpmwZUz2L7AfBtF9vn4ggTH33hmeufDULbP3YgNZ/C+ss/oO3stbrqRQyaOmRwy70y7BGTGO81S3rA=="], + "libsql": ["libsql@0.5.29", "", { "dependencies": { "@neon-rs/load": "^0.0.4", "detect-libc": "2.0.2" }, "optionalDependencies": { "@libsql/darwin-arm64": "0.5.29", "@libsql/darwin-x64": "0.5.29", "@libsql/linux-arm-gnueabihf": "0.5.29", "@libsql/linux-arm-musleabihf": "0.5.29", "@libsql/linux-arm64-gnu": "0.5.29", "@libsql/linux-arm64-musl": "0.5.29", "@libsql/linux-x64-gnu": "0.5.29", "@libsql/linux-x64-musl": "0.5.29", "@libsql/win32-x64-msvc": "0.5.29" }, "os": [ "linux", "win32", "darwin", ], "cpu": [ "arm", "x64", "arm64", ] }, "sha512-8lMP8iMgiBzzoNbAPQ59qdVcj6UaE/Vnm+fiwX4doX4Narook0a4GPKWBEv+CR8a1OwbfkgL18uBfBjWdF0Fzg=="], + "lightningcss": ["lightningcss@1.32.0", "", { "dependencies": { "detect-libc": "^2.0.3" }, "optionalDependencies": { "lightningcss-android-arm64": "1.32.0", "lightningcss-darwin-arm64": "1.32.0", "lightningcss-darwin-x64": "1.32.0", "lightningcss-freebsd-x64": "1.32.0", "lightningcss-linux-arm-gnueabihf": "1.32.0", "lightningcss-linux-arm64-gnu": "1.32.0", "lightningcss-linux-arm64-musl": "1.32.0", "lightningcss-linux-x64-gnu": "1.32.0", "lightningcss-linux-x64-musl": "1.32.0", "lightningcss-win32-arm64-msvc": "1.32.0", "lightningcss-win32-x64-msvc": "1.32.0" } }, "sha512-NXYBzinNrblfraPGyrbPoD19C1h9lfI/1mzgWYvXUTe414Gz/X1FD2XBZSZM7rRTrMA8JL3OtAaGifrIKhQ5yQ=="], "lightningcss-android-arm64": ["lightningcss-android-arm64@1.32.0", "", { "os": "android", "cpu": "arm64" }, "sha512-YK7/ClTt4kAK0vo6w3X+Pnm0D2cf2vPHbhOXdoNti1Ga0al1P4TBZhwjATvjNwLEBCnKvjJc2jQgHXH0NEwlAg=="], @@ -3800,6 +3932,8 @@ "nanoid": ["nanoid@5.1.9", "", { "bin": { "nanoid": "bin/nanoid.js" } }, "sha512-ZUvP7KeBLe3OZ1ypw6dI/TzYJuvHP77IM4Ry73waSQTLn8/g8rpdjfyVAh7t1/+FjBtG4lCP42MEbDxOsRpBMw=="], + "nanostores": ["nanostores@1.3.0", "", {}, "sha512-XPUa/jz+P1oJvN9VBxw4L9MtdFfaH3DAryqPssqhb2kXjmb9npz0dly6rCsgFWOPr4Yg9mTfM3MDZgZZ+7A3lA=="], + "napi-build-utils": ["napi-build-utils@2.0.0", "", {}, "sha512-GEbrYkbfF7MoNaoh2iGG84Mnf/WZfB0GdGEsM8wz7Expx/LlWf5U8t9nvJKXSp3qr5IsEbK04cBGhol/KwOsWA=="], "negotiator": ["negotiator@1.0.0", "", {}, "sha512-8Ofs/AUQh8MaEcrlq5xOX0CQ9ypTF5dl78mjlMNfOK08fzpgTHQRQPBxcPlEtIw0yRpws+Zo/3r+5WRby7u3Gg=="], @@ -3814,6 +3948,10 @@ "node-api-version": ["node-api-version@0.2.1", "", { "dependencies": { "semver": "^7.3.5" } }, "sha512-2xP/IGGMmmSQpI1+O/k72jF/ykvZ89JeuKX3TLJAYPDVLUalrshrLHkeVcCCZqG/eEa635cr8IBYzgnDvM2O8Q=="], + "node-domexception": ["node-domexception@1.0.0", "", {}, "sha512-/jKZoMpw0F8GRwl4/eLROPA3cfcXtLApP0QzLmUT/HuPCZWyB7IY9ZrMeKw2O/nFIqPQB3PVM9aYm0F312AXDQ=="], + + "node-fetch": ["node-fetch@3.3.2", "", { "dependencies": { "data-uri-to-buffer": "^4.0.0", "fetch-blob": "^3.1.4", "formdata-polyfill": "^4.0.10" } }, "sha512-dRB78srN/l6gqWulah9SrxeYnxeddIG30+GOqK/9OlLVyLg3HPnr6SqOWTWOXKRwC2eGYCkZ59NNuSgvSrpgOA=="], + "node-fetch-native": ["node-fetch-native@1.6.7", "", {}, "sha512-g9yhqoedzIUm0nTnTqAQvueMPVOuIY16bqgAJJC8XOOubYFNwz6IER9qs0Gq2Xd0+CecCKFjtdDTMA4u4xG06Q=="], "node-gyp": ["node-gyp@12.3.0", "", { "dependencies": { "env-paths": "^2.2.0", "exponential-backoff": "^3.1.1", "graceful-fs": "^4.2.6", "nopt": "^9.0.0", "proc-log": "^6.0.0", "semver": "^7.3.5", "tar": "^7.5.4", "tinyglobby": "^0.2.12", "undici": "^6.25.0", "which": "^6.0.0" }, "bin": { "node-gyp": "bin/node-gyp.js" } }, "sha512-QNcUWM+HgJplcPzBvFBZ9VXacyGZ4+VTOb80PwWR+TlVzoHbRKULNEzpRsnaoxG3Wzr7Qh7BYxGDU3CbKib2Yg=="], @@ -4020,6 +4158,8 @@ "progress": ["progress@2.0.3", "", {}, "sha512-7PiHtLll5LdnKIMw100I+8xJXR5gW2QwWYkT6iJva0bXitZKa/XMrSbdmg3r2Xnaidz9Qumd0VPaMrZlF9V9sA=="], + "promise-limit": ["promise-limit@2.7.0", "", {}, "sha512-7nJ6v5lnJsXwGprnGXga4wx6d1POjvi5Qmf1ivTRxTjH4Z/9Czja/UCMLVmB9N93GeWOU93XaFaEt6jbuoagNw=="], + "promise-retry": ["promise-retry@2.0.1", "", { "dependencies": { "err-code": "^2.0.2", "retry": "^0.12.0" } }, "sha512-y+WKFlBR8BGXnsNlIHFGPZmyDf3DFMoLhaflAnyZgV6rG6xu+JwesTo2Q9R6XwYmtmwAFCkAk3e35jEdoeh/3g=="], "prompts": ["prompts@2.4.2", "", { "dependencies": { "kleur": "^3.0.3", "sisteransi": "^1.0.5" } }, "sha512-NxNv/kLguCA7p3jE8oL2aEBsrJWgAakBpgmgK6lpPWV+WuOmY6r2/zbAVnP+T8bQlA0nzHXSJSJW0Hq7ylaD2Q=="], @@ -4306,6 +4446,8 @@ "serve-static": ["serve-static@2.2.1", "", { "dependencies": { "encodeurl": "^2.0.0", "escape-html": "^1.0.3", "parseurl": "^1.3.3", "send": "^1.2.0" } }, "sha512-xRXBn0pPqQTVQiC8wyQrKs2MOlX24zQ0POGaj0kultvoOCstBQM5yvOhAVSUwOMjQtTvsPWoNCHfPGwaaQJhTw=="], + "set-cookie-parser": ["set-cookie-parser@3.1.0", "", {}, "sha512-kjnC1DXBHcxaOaOXBHBeRtltsDG2nUiUni+jP92M9gYdW12rsmx92UsfpH7o5tDRs7I1ZZPSQJQGv3UaRfCiuw=="], + "set-function-length": ["set-function-length@1.2.2", "", { "dependencies": { "define-data-property": "^1.1.4", "es-errors": "^1.3.0", "function-bind": "^1.1.2", "get-intrinsic": "^1.2.4", "gopd": "^1.0.1", "has-property-descriptors": "^1.0.2" } }, "sha512-pgRc4hJ4/sNjWCSS9AmnS40x3bNMDTknHgL5UaMBTMyJnU90EgWh1Rz+MC9eFu4BuN/UwZjKQuY/1v3rM7HMfg=="], "set-value": ["set-value@2.0.1", "", { "dependencies": { "extend-shallow": "^2.0.1", "is-extendable": "^0.1.1", "is-plain-object": "^2.0.3", "split-string": "^3.0.1" } }, "sha512-JxHc1weCN68wRY0fhCoXpyK55m/XPHafOmK4UWD7m2CI14GMcFypt4w/0+NV5f/ZMby2F6S2wwA7fgynh9gWSw=="], @@ -4660,6 +4802,8 @@ "web-namespaces": ["web-namespaces@2.0.1", "", {}, "sha512-bKr1DkiNa2krS7qxNtdrtHAmzuYGFQLiQ13TsorsdT6ULTkPLKuu5+GsFpDlg6JFjUTwX2DyhMPG2be8uPrqsQ=="], + "web-streams-polyfill": ["web-streams-polyfill@3.3.3", "", {}, "sha512-d2JWLCivmZYTSIoge9MsgFCZrt571BikcWGYkjC1khllbTeDlGqZ2D8vD8E/lJa8WGWbb7Plm8/XJYV7IJHZZw=="], + "web-vitals": ["web-vitals@5.2.0", "", {}, "sha512-i2z98bEmaCqSDiHEDu+gHl/dmR4Q+TxFmG3/13KkMO+o8UxQzCqWaDRCiLgEa41nlO4VpXSI0ASa1xWmO9sBlA=="], "webpack-virtual-modules": ["webpack-virtual-modules@0.6.2", "", {}, "sha512-66/V2i5hQanC51vBQKPH4aI8NMAcBW59FVBs+rC7eGHupMyfn34q7rZIE+ETlJ+XTevqfUhVVBgSUNSW2flEUQ=="], @@ -4760,6 +4904,8 @@ "@babel/helper-create-class-features-plugin/semver": ["semver@6.3.1", "", { "bin": { "semver": "bin/semver.js" } }, "sha512-BR7VvDCVHO+q2xBEWskxS6DJE1qRnb7DxzUrogb71CWoSficBxYsiAGd+Kl0mmq/MprG9yArRkyrQxTO6XjMzA=="], + "@better-auth/core/jose": ["jose@6.2.2", "", {}, "sha512-d7kPDd34KO/YnzaDOlikGpOurfF0ByC2sEV4cANCtdqLlTfBlw2p14O/5d/zv40gJPbIQxfES3nSx1/oYNyuZQ=="], + "@changesets/apply-release-plan/prettier": ["prettier@2.8.8", "", { "bin": { "prettier": "bin-prettier.js" } }, "sha512-tdN8qQGvNjw4CHbY+XXk0JgCXn9QiF21a55rBe5LJAU+kDyC4WQn4+awm2Xfk2lQMk5fKup9XgzTZtGkjBdP9Q=="], "@changesets/write/prettier": ["prettier@2.8.8", "", { "bin": { "prettier": "bin-prettier.js" } }, "sha512-tdN8qQGvNjw4CHbY+XXk0JgCXn9QiF21a55rBe5LJAU+kDyC4WQn4+awm2Xfk2lQMk5fKup9XgzTZtGkjBdP9Q=="], @@ -4846,6 +4992,10 @@ "@isaacs/cliui/wrap-ansi": ["wrap-ansi@8.1.0", "", { "dependencies": { "ansi-styles": "^6.1.0", "string-width": "^5.0.1", "strip-ansi": "^7.0.1" } }, "sha512-si7QWI6zUMq56bESFvagtmzMdGOtoxfR+Sez11Mobfc7tm+VkUckk9bW2UeffTGVUbOksxmSw0AA2gs8g71NCQ=="], + "@libsql/isomorphic-ws/ws": ["ws@8.20.0", "", { "peerDependencies": { "bufferutil": "^4.0.1", "utf-8-validate": ">=5.0.2" }, "optionalPeers": ["bufferutil", "utf-8-validate"] }, "sha512-sAt8BhgNbzCtgGbt2OxmpuryO63ZoDk/sqaB/znQm94T4fCEsy/yV+7CdC1kJhOU9lboAEU7R3kquuycDoibVA=="], + + "@libsql/kysely-libsql/@libsql/client": ["@libsql/client@0.8.1", "", { "dependencies": { "@libsql/core": "^0.8.1", "@libsql/hrana-client": "^0.6.2", "js-base64": "^3.7.5", "libsql": "^0.3.10", "promise-limit": "^2.7.0" } }, "sha512-xGg0F4iTDFpeBZ0r4pA6icGsYa5rG6RAG+i/iLDnpCAnSuTqEWMDdPlVseiq4Z/91lWI9jvvKKiKpovqJ1kZWA=="], + "@lobehub/fluent-emoji/emoji-regex": ["emoji-regex@10.6.0", "", {}, "sha512-toUI84YS5YmxW219erniWD0CIVOo46xGKColeNQRgOzDorgBi1v4D71/OFzgD9GO2UGKIv1C3Sp8DAn0+j5w7A=="], "@lobehub/fluent-emoji/lucide-react": ["lucide-react@0.562.0", "", { "peerDependencies": { "react": "^16.5.1 || ^17.0.0 || ^18.0.0 || ^19.0.0" } }, "sha512-82hOAu7y0dbVuFfmO4bYF1XEwYk/mEbM5E+b1jgci/udUBEE/R7LF5Ip0CCEmXe8AybRM8L+04eP+LGZeDvkiw=="], @@ -5052,6 +5202,10 @@ "atmn/commander": ["commander@14.0.3", "", {}, "sha512-H+y0Jo/T1RZ9qPP4Eh1pkcQcLRglraJaSLoyOtHxu6AapkjWVCy2Sit1QQ4x3Dng8qDlSsZEet7g5Pq06MvTgw=="], + "better-auth/jose": ["jose@6.2.2", "", {}, "sha512-d7kPDd34KO/YnzaDOlikGpOurfF0ByC2sEV4cANCtdqLlTfBlw2p14O/5d/zv40gJPbIQxfES3nSx1/oYNyuZQ=="], + + "better-call/rou3": ["rou3@0.7.12", "", {}, "sha512-iFE4hLDuloSWcD7mjdCDhx2bKcIsYbtOTpfH5MHHLSKMOUyjqQXTeZVa289uuwEGEKFoE/BAPbhaU4B774nceg=="], + "bl/buffer": ["buffer@5.7.1", "", { "dependencies": { "base64-js": "^1.3.1", "ieee754": "^1.1.13" } }, "sha512-EHcyIPBQ4BSGlvjB16k5KgAJ27CIsHY/2JBmCRReo48y9rQ3MaUzWX3KVlBa4U7MyX02HdVj0K7C3WaB3ju7FQ=="], "builder-util/chalk": ["chalk@4.1.2", "", { "dependencies": { "ansi-styles": "^4.1.0", "supports-color": "^7.1.0" } }, "sha512-oKnbhFyRIXpUuez8iBMmyEa4nbj4IOQyuhc/wy9kY7/WVPcwIO9VA668Pu8RkO7+0G76SLROeyw9CpQ061i4mA=="], @@ -5162,6 +5316,8 @@ "katex/commander": ["commander@8.3.0", "", {}, "sha512-OkTL9umf+He2DZkUq8f8J9of7yL6RJKI24dVITBmNfZBmri9zYZQrKkuXiKhyfPSu8tUhnVBB1iKXevvnlR4Ww=="], + "libsql/detect-libc": ["detect-libc@2.0.2", "", {}, "sha512-UX6sGumvvqSaXgdKGUsgZWqcUyIXZ/vZTrlRT/iobiKhGL0zL4d3osHj3uqllWJK+i+sixDS/3COVEOFbupFyw=="], + "log-symbols/is-unicode-supported": ["is-unicode-supported@1.3.0", "", {}, "sha512-43r2mRvz+8JRIKnWJ+3j8JtjRKZ6GmjzfaE/qiBJnikNnYv/6bagRJ1kUhNk8R5EX/GkobD+r+sfxCPJsiKBLQ=="], "matcher/escape-string-regexp": ["escape-string-regexp@4.0.0", "", {}, "sha512-TtpcNJ3XAzx3Gq8sWRzJaVajRs0uVxA2YAkdb1jm2YkPz4G6egUFAyA3n5vtEIZefPk5Wa4UXbKuS5fKkJWdgA=="], @@ -5444,6 +5600,12 @@ "@isaacs/cliui/strip-ansi/ansi-regex": ["ansi-regex@6.2.2", "", {}, "sha512-Bq3SmSpyFHaWjPk8If9yc6svM8c56dB5BAtW4Qbw5jHTwwXXcTLoRMkpDJp6VL0XzlWaCHTXrkFURMYmD0sLqg=="], + "@libsql/kysely-libsql/@libsql/client/@libsql/core": ["@libsql/core@0.8.1", "", { "dependencies": { "js-base64": "^3.7.5" } }, "sha512-u6nrj6HZMTPsgJ9EBhLzO2uhqhlHQJQmVHV+0yFLvfGf3oSP8w7TjZCNUgu1G8jHISx6KFi7bmcrdXW9lRt++A=="], + + "@libsql/kysely-libsql/@libsql/client/@libsql/hrana-client": ["@libsql/hrana-client@0.6.2", "", { "dependencies": { "@libsql/isomorphic-fetch": "^0.2.1", "@libsql/isomorphic-ws": "^0.1.5", "js-base64": "^3.7.5", "node-fetch": "^3.3.2" } }, "sha512-MWxgD7mXLNf9FXXiM0bc90wCjZSpErWKr5mGza7ERy2FJNNMXd7JIOv+DepBA1FQTIfI8TFO4/QDYgaQC0goNw=="], + + "@libsql/kysely-libsql/@libsql/client/libsql": ["libsql@0.3.19", "", { "dependencies": { "@neon-rs/load": "^0.0.4", "detect-libc": "2.0.2", "libsql": "^0.3.15" }, "optionalDependencies": { "@libsql/darwin-arm64": "0.3.19", "@libsql/darwin-x64": "0.3.19", "@libsql/linux-arm64-gnu": "0.3.19", "@libsql/linux-arm64-musl": "0.3.19", "@libsql/linux-x64-gnu": "0.3.19", "@libsql/linux-x64-musl": "0.3.19", "@libsql/win32-x64-msvc": "0.3.19" }, "os": [ "linux", "win32", "darwin", ], "cpu": [ "x64", "arm64", ] }, "sha512-Aj5cQ5uk/6fHdmeW0TiXK42FqUlwx7ytmMLPSaUQPin5HKKKuUPD62MAbN4OEweGBBI7q1BekoEN4gPUEL6MZA=="], + "@lobehub/ui/@base-ui/react/@base-ui/utils": ["@base-ui/utils@0.2.3", "", { "dependencies": { "@babel/runtime": "^7.28.4", "@floating-ui/utils": "^0.2.10", "reselect": "^5.1.1", "use-sync-external-store": "^1.6.0" }, "peerDependencies": { "@types/react": "^17 || ^18 || ^19", "react": "^17 || ^18 || ^19", "react-dom": "^17 || ^18 || ^19" }, "optionalPeers": ["@types/react"] }, "sha512-/CguQ2PDaOzeVOkllQR8nocJ0FFIDqsWIcURsVmm53QGo8NhFNpePjNlyPIB41luxfOqnG7PU0xicMEw3ls7XQ=="], "@malept/flatpak-bundler/fs-extra/jsonfile": ["jsonfile@6.2.1", "", { "dependencies": { "universalify": "^2.0.0" }, "optionalDependencies": { "graceful-fs": "^4.1.6" } }, "sha512-zwOTdL3rFQ/lRdBnntKVOX6k5cKJwEc1HdilT71BWEu7J41gXIB2MRp+vxduPSwZJPWBxEzv4yH1wYLJGUHX4Q=="], @@ -5872,6 +6034,22 @@ "@inquirer/core/wrap-ansi/string-width/is-fullwidth-code-point": ["is-fullwidth-code-point@3.0.0", "", {}, "sha512-zymm5+u+sCsSWyD9qNaejV3DFvhCKclKdizYaJUuHA83RLjb7nSuGnddCHGv0hk+KY7BMAlsWeK4Ueg6EV6XQg=="], + "@libsql/kysely-libsql/@libsql/client/libsql/@libsql/darwin-arm64": ["@libsql/darwin-arm64@0.3.19", "", { "os": "darwin", "cpu": "arm64" }, "sha512-rmOqsLcDI65zzxlUOoEiPJLhqmbFsZF6p4UJQ2kMqB+Kc0Rt5/A1OAdOZ/Wo8fQfJWjR1IbkbpEINFioyKf+nQ=="], + + "@libsql/kysely-libsql/@libsql/client/libsql/@libsql/darwin-x64": ["@libsql/darwin-x64@0.3.19", "", { "os": "darwin", "cpu": "x64" }, "sha512-q9O55B646zU+644SMmOQL3FIfpmEvdWpRpzubwFc2trsa+zoBlSkHuzU9v/C+UNoPHQVRMP7KQctJ455I/h/xw=="], + + "@libsql/kysely-libsql/@libsql/client/libsql/@libsql/linux-arm64-gnu": ["@libsql/linux-arm64-gnu@0.3.19", "", { "os": "linux", "cpu": "arm64" }, "sha512-mgeAUU1oqqh57k7I3cQyU6Trpdsdt607eFyEmH5QO7dv303ti+LjUvh1pp21QWV6WX7wZyjeJV1/VzEImB+jRg=="], + + "@libsql/kysely-libsql/@libsql/client/libsql/@libsql/linux-arm64-musl": ["@libsql/linux-arm64-musl@0.3.19", "", { "os": "linux", "cpu": "arm64" }, "sha512-VEZtxghyK6zwGzU9PHohvNxthruSxBEnRrX7BSL5jQ62tN4n2JNepJ6SdzXp70pdzTfwroOj/eMwiPt94gkVRg=="], + + "@libsql/kysely-libsql/@libsql/client/libsql/@libsql/linux-x64-gnu": ["@libsql/linux-x64-gnu@0.3.19", "", { "os": "linux", "cpu": "x64" }, "sha512-2t/J7LD5w2f63wGihEO+0GxfTyYIyLGEvTFEsMO16XI5o7IS9vcSHrxsvAJs4w2Pf907uDjmc7fUfMg6L82BrQ=="], + + "@libsql/kysely-libsql/@libsql/client/libsql/@libsql/linux-x64-musl": ["@libsql/linux-x64-musl@0.3.19", "", { "os": "linux", "cpu": "x64" }, "sha512-BLsXyJaL8gZD8+3W2LU08lDEd9MIgGds0yPy5iNPp8tfhXx3pV/Fge2GErN0FC+nzt4DYQtjL+A9GUMglQefXQ=="], + + "@libsql/kysely-libsql/@libsql/client/libsql/@libsql/win32-x64-msvc": ["@libsql/win32-x64-msvc@0.3.19", "", { "os": "win32", "cpu": "x64" }, "sha512-ay1X9AobE4BpzG0XPw1gplyLZPGHIgJOovvW23gUrukRegiUP62uzhpRbKNogLlUOynyXeq//prHgPXiebUfWg=="], + + "@libsql/kysely-libsql/@libsql/client/libsql/detect-libc": ["detect-libc@2.0.2", "", {}, "sha512-UX6sGumvvqSaXgdKGUsgZWqcUyIXZ/vZTrlRT/iobiKhGL0zL4d3osHj3uqllWJK+i+sixDS/3COVEOFbupFyw=="], + "agents/yargs/cliui/strip-ansi": ["strip-ansi@7.2.0", "", { "dependencies": { "ansi-regex": "^6.2.2" } }, "sha512-yDPMNjp4WyfYBkHnjIRLfca1i6KMyGCtsVgoKe/z1+6vukgaENdgGBZt+ZmKPc4gavvEZ5OgHfHdrazhgNyG7w=="], "agents/yargs/string-width/emoji-regex": ["emoji-regex@10.6.0", "", {}, "sha512-toUI84YS5YmxW219erniWD0CIVOo46xGKColeNQRgOzDorgBi1v4D71/OFzgD9GO2UGKIv1C3Sp8DAn0+j5w7A=="], diff --git a/package.json b/package.json index dbf619b51..fb91e64a6 100644 --- a/package.json +++ b/package.json @@ -98,6 +98,8 @@ "bun-types": "^1.2.22", "drizzle-orm": "^0.45.0", "drizzle-kit": "^0.31.10", + "@libsql/client": "^0.17.3", + "@libsql/kysely-libsql": "^0.4.1", "@vitest/expect": "^4.1.5", "@vitest/mocker": "^4.1.5", "@vitest/pretty-format": "^4.1.5", diff --git a/packages/core/api/package.json b/packages/core/api/package.json index f3144b3d9..a7c6bde8b 100644 --- a/packages/core/api/package.json +++ b/packages/core/api/package.json @@ -15,6 +15,7 @@ }, "dependencies": { "@executor-js/execution": "workspace:*", + "@executor-js/host-mcp": "workspace:*", "@executor-js/sdk": "workspace:*", "effect": "catalog:" }, diff --git a/packages/core/api/src/account/api.ts b/packages/core/api/src/account/api.ts new file mode 100644 index 000000000..0eaa8181f --- /dev/null +++ b/packages/core/api/src/account/api.ts @@ -0,0 +1,242 @@ +import { HttpApi, HttpApiEndpoint, HttpApiGroup } from "effect/unstable/httpapi"; +import { Schema } from "effect"; + +// --------------------------------------------------------------------------- +// Provider-neutral Account API. +// +// This is the multiplayer "account" surface that BOTH the cloud (WorkOS) and +// self-host (Better Auth) servers implement, at the SAME paths, so the shared +// React UI (shell, api-keys page, org page) is identical for both — only the +// server-side handler implementations and the login UX differ per provider. +// +// Deliberately minimal: it covers exactly what the shared shell + pages need +// (who am I, API keys, org members). Provider-specific surfaces that only one +// product has — cloud's multi-org switcher, WorkOS domains, billing — stay in +// app-local API groups and are wired into the shell through injected slots, +// NOT into this contract. That keeps the shared typed client fully implemented +// by both servers (no half-built HttpApi layers). +// --------------------------------------------------------------------------- + +// ── Neutral errors ───────────────────────────────────────────────────────── +// Each provider maps its native failures (WorkOSError, Better Auth APIError, +// storage faults) onto these at the handler boundary, so the UI handles one +// neutral shape. + +export class AccountError extends Schema.TaggedErrorClass()( + "AccountError", + { message: Schema.String }, + { httpApiStatus: 500 }, +) {} + +export class AccountForbidden extends Schema.TaggedErrorClass()( + "AccountForbidden", + { message: Schema.optional(Schema.String) }, + { httpApiStatus: 403 }, +) {} + +export class AccountNoOrganization extends Schema.TaggedErrorClass()( + "AccountNoOrganization", + {}, + { httpApiStatus: 403 }, +) {} + +export class AccountUnauthorized extends Schema.TaggedErrorClass()( + "AccountUnauthorized", + {}, + { httpApiStatus: 401 }, +) {} + +// ── Shared shapes ──────────────────────────────────────────────────────────── + +export const AccountUser = Schema.Struct({ + id: Schema.String, + email: Schema.String, + name: Schema.NullOr(Schema.String), + avatarUrl: Schema.NullOr(Schema.String), +}); + +export const AccountOrganization = Schema.Struct({ + id: Schema.String, + name: Schema.String, +}); + +export const AccountMeResponse = Schema.Struct({ + user: AccountUser, + organization: Schema.NullOr(AccountOrganization), +}); + +export const ApiKeySummary = Schema.Struct({ + id: Schema.String, + name: Schema.String, + /** Masked display value (e.g. "exk_…a1b2"). The full secret is only ever + * returned once, from `createApiKey`. */ + obfuscatedValue: Schema.String, + createdAt: Schema.String, + updatedAt: Schema.String, + lastUsedAt: Schema.NullOr(Schema.String), +}); + +export const ApiKeysResponse = Schema.Struct({ + apiKeys: Schema.Array(ApiKeySummary), +}); + +export const CreateApiKeyBody = Schema.Struct({ + name: Schema.String, +}); + +/** Create returns the summary PLUS the one-time plaintext `value`. */ +export const CreatedApiKeyResponse = Schema.Struct({ + id: Schema.String, + name: Schema.String, + obfuscatedValue: Schema.String, + createdAt: Schema.String, + updatedAt: Schema.String, + lastUsedAt: Schema.NullOr(Schema.String), + value: Schema.String, +}); + +export const OrgMember = Schema.Struct({ + id: Schema.String, + userId: Schema.String, + email: Schema.String, + name: Schema.NullOr(Schema.String), + avatarUrl: Schema.NullOr(Schema.String), + role: Schema.String, + status: Schema.String, + lastActiveAt: Schema.NullOr(Schema.String), + isCurrentUser: Schema.Boolean, +}); + +/** Seat usage. Self-host (unlimited) reports `unlimited: true`; cloud reports + * real plan seats. Optional so providers without a seat model can omit it. */ +export const OrgMemberSeats = Schema.Struct({ + used: Schema.Number, + granted: Schema.Number, + unlimited: Schema.Boolean, +}); + +export const OrgMembersResponse = Schema.Struct({ + members: Schema.Array(OrgMember), + seats: Schema.optional(OrgMemberSeats), +}); + +export const OrgRole = Schema.Struct({ + slug: Schema.String, + name: Schema.String, +}); + +export const OrgRolesResponse = Schema.Struct({ + roles: Schema.Array(OrgRole), +}); + +export const InviteMemberBody = Schema.Struct({ + email: Schema.String, + roleSlug: Schema.optional(Schema.String), +}); + +export const InviteMemberResponse = Schema.Struct({ + id: Schema.String, + email: Schema.String, +}); + +export const UpdateMemberRoleBody = Schema.Struct({ + roleSlug: Schema.String, +}); + +export const UpdateOrgNameBody = Schema.Struct({ + name: Schema.String, +}); + +export const UpdateOrgNameResponse = Schema.Struct({ + name: Schema.String, +}); + +export const SuccessResponse = Schema.Struct({ + success: Schema.Boolean, +}); + +const ApiKeyParams = { apiKeyId: Schema.String }; +const MembershipParams = { membershipId: Schema.String }; + +// ── Group ──────────────────────────────────────────────────────────────────── + +/** + * The neutral account group. Mounted at `/account/*` by both servers. Auth is + * applied by each server's own session middleware (cookie-based, same-origin), + * so this contract carries no provider-specific auth scheme. + */ +export const AccountApi = HttpApiGroup.make("account") + .add( + HttpApiEndpoint.get("me", "/account/me", { + success: AccountMeResponse, + error: [AccountError, AccountUnauthorized], + }), + ) + .add( + HttpApiEndpoint.get("listApiKeys", "/account/api-keys", { + success: ApiKeysResponse, + error: [AccountError, AccountUnauthorized, AccountNoOrganization], + }), + ) + .add( + HttpApiEndpoint.post("createApiKey", "/account/api-keys", { + payload: CreateApiKeyBody, + success: CreatedApiKeyResponse, + error: [AccountError, AccountUnauthorized, AccountNoOrganization], + }), + ) + .add( + HttpApiEndpoint.delete("revokeApiKey", "/account/api-keys/:apiKeyId", { + params: ApiKeyParams, + success: SuccessResponse, + error: [AccountError, AccountUnauthorized, AccountNoOrganization], + }), + ) + .add( + HttpApiEndpoint.get("listMembers", "/account/members", { + success: OrgMembersResponse, + error: [AccountError, AccountUnauthorized, AccountNoOrganization], + }), + ) + .add( + HttpApiEndpoint.get("listRoles", "/account/roles", { + success: OrgRolesResponse, + error: [AccountError, AccountUnauthorized, AccountNoOrganization], + }), + ) + .add( + HttpApiEndpoint.post("inviteMember", "/account/members/invite", { + payload: InviteMemberBody, + success: InviteMemberResponse, + error: [AccountError, AccountUnauthorized, AccountForbidden, AccountNoOrganization], + }), + ) + .add( + HttpApiEndpoint.delete("removeMember", "/account/members/:membershipId", { + params: MembershipParams, + success: SuccessResponse, + error: [AccountError, AccountUnauthorized, AccountForbidden, AccountNoOrganization], + }), + ) + .add( + HttpApiEndpoint.patch("updateMemberRole", "/account/members/:membershipId/role", { + params: MembershipParams, + payload: UpdateMemberRoleBody, + success: SuccessResponse, + error: [AccountError, AccountUnauthorized, AccountForbidden, AccountNoOrganization], + }), + ) + .add( + HttpApiEndpoint.patch("updateOrgName", "/account/name", { + payload: UpdateOrgNameBody, + success: UpdateOrgNameResponse, + error: [AccountError, AccountUnauthorized, AccountForbidden, AccountNoOrganization], + }), + ); + +/** + * Standalone HttpApi wrapping just the account group — used to build the shared + * `AccountApiClient` in `@executor-js/react`. Servers don't use this; they add + * `AccountApi` to their own full API so it's served alongside the core groups. + */ +export const AccountHttpApi = HttpApi.make("executor-account").add(AccountApi); diff --git a/packages/core/api/src/account/handlers.ts b/packages/core/api/src/account/handlers.ts new file mode 100644 index 000000000..76e6ea010 --- /dev/null +++ b/packages/core/api/src/account/handlers.ts @@ -0,0 +1,87 @@ +import { HttpApiBuilder } from "effect/unstable/httpapi"; +import { HttpServerRequest } from "effect/unstable/http"; +import { Effect } from "effect"; + +import { AccountHttpApi } from "./api"; +import { AccountProvider, type AccountHeaders } from "./service"; + +// --------------------------------------------------------------------------- +// Shared, provider-neutral handlers for the Account API. They do nothing but +// read the request headers and delegate to the injected `AccountProvider`, so +// both cloud and self-host serve identical routes — only the service impl +// differs. The neutral errors thrown by the service map directly to their HTTP +// statuses (401/403/500) via the contract annotations. +// --------------------------------------------------------------------------- + +const requestHeaders = Effect.map( + HttpServerRequest.HttpServerRequest.asEffect(), + (req): AccountHeaders => ({ ...req.headers }), +); + +export const AccountHandlers = HttpApiBuilder.group(AccountHttpApi, "account", (handlers) => + handlers + .handle("me", () => + Effect.gen(function* () { + const headers = yield* requestHeaders; + return yield* (yield* AccountProvider).me(headers); + }), + ) + .handle("listApiKeys", () => + Effect.gen(function* () { + const headers = yield* requestHeaders; + return yield* (yield* AccountProvider).listApiKeys(headers); + }), + ) + .handle("createApiKey", ({ payload }) => + Effect.gen(function* () { + const headers = yield* requestHeaders; + return yield* (yield* AccountProvider).createApiKey(headers, payload.name); + }), + ) + .handle("revokeApiKey", ({ params }) => + Effect.gen(function* () { + const headers = yield* requestHeaders; + return yield* (yield* AccountProvider).revokeApiKey(headers, params.apiKeyId); + }), + ) + .handle("listMembers", () => + Effect.gen(function* () { + const headers = yield* requestHeaders; + return yield* (yield* AccountProvider).listMembers(headers); + }), + ) + .handle("listRoles", () => + Effect.gen(function* () { + const headers = yield* requestHeaders; + return yield* (yield* AccountProvider).listRoles(headers); + }), + ) + .handle("inviteMember", ({ payload }) => + Effect.gen(function* () { + const headers = yield* requestHeaders; + return yield* (yield* AccountProvider).inviteMember(headers, payload); + }), + ) + .handle("removeMember", ({ params }) => + Effect.gen(function* () { + const headers = yield* requestHeaders; + return yield* (yield* AccountProvider).removeMember(headers, params.membershipId); + }), + ) + .handle("updateMemberRole", ({ params, payload }) => + Effect.gen(function* () { + const headers = yield* requestHeaders; + return yield* (yield* AccountProvider).updateMemberRole( + headers, + params.membershipId, + payload.roleSlug, + ); + }), + ) + .handle("updateOrgName", ({ payload }) => + Effect.gen(function* () { + const headers = yield* requestHeaders; + return yield* (yield* AccountProvider).updateOrgName(headers, payload.name); + }), + ), +); diff --git a/packages/core/api/src/account/service.ts b/packages/core/api/src/account/service.ts new file mode 100644 index 000000000..2f81212d6 --- /dev/null +++ b/packages/core/api/src/account/service.ts @@ -0,0 +1,75 @@ +import { Context, type Effect } from "effect"; + +import { + type AccountError, + type AccountForbidden, + type AccountNoOrganization, + type AccountUnauthorized, + AccountMeResponse, + ApiKeysResponse, + CreatedApiKeyResponse, + OrgMembersResponse, + OrgRolesResponse, + InviteMemberResponse, + InviteMemberBody, + SuccessResponse, + UpdateOrgNameResponse, +} from "./api"; + +// --------------------------------------------------------------------------- +// AccountProvider — the provider seam behind the neutral Account API. +// +// The shared `AccountHandlers` (account/handlers.ts) are generic: they read the +// request headers and delegate to this service, mapping nothing. Each product +// provides its own implementation: +// - self-host → Better Auth (auth.api.*) +// - cloud → WorkOS +// This is the server-side analog of the client's neutral contract: one set of +// handlers, two implementations. Methods take the raw request headers (cookie / +// bearer / api-key) so the implementation can act as the calling user. +// --------------------------------------------------------------------------- + +export type AccountHeaders = Record; + +type Me = typeof AccountMeResponse.Type; +type ApiKeys = typeof ApiKeysResponse.Type; +type CreatedApiKey = typeof CreatedApiKeyResponse.Type; +type Members = typeof OrgMembersResponse.Type; +type Roles = typeof OrgRolesResponse.Type; +type Invite = typeof InviteMemberResponse.Type; +type InviteBody = typeof InviteMemberBody.Type; +type Success = typeof SuccessResponse.Type; +type OrgName = typeof UpdateOrgNameResponse.Type; + +type Authed = Effect.Effect; +type OrgScoped = Authed; + +export interface AccountProviderShape { + readonly me: (headers: AccountHeaders) => Authed; + readonly listApiKeys: (headers: AccountHeaders) => OrgScoped; + readonly createApiKey: (headers: AccountHeaders, name: string) => OrgScoped; + readonly revokeApiKey: (headers: AccountHeaders, apiKeyId: string) => OrgScoped; + readonly listMembers: (headers: AccountHeaders) => OrgScoped; + readonly listRoles: (headers: AccountHeaders) => OrgScoped; + readonly inviteMember: ( + headers: AccountHeaders, + body: InviteBody, + ) => OrgScoped; + readonly removeMember: ( + headers: AccountHeaders, + membershipId: string, + ) => OrgScoped; + readonly updateMemberRole: ( + headers: AccountHeaders, + membershipId: string, + roleSlug: string, + ) => OrgScoped; + readonly updateOrgName: ( + headers: AccountHeaders, + name: string, + ) => OrgScoped; +} + +export class AccountProvider extends Context.Service()( + "@executor-js/api/AccountProvider", +) {} diff --git a/packages/core/api/src/client.ts b/packages/core/api/src/client.ts index a1c8ce1d7..89857cbda 100644 --- a/packages/core/api/src/client.ts +++ b/packages/core/api/src/client.ts @@ -7,3 +7,11 @@ export { ExecutionsApi } from "./executions/api"; export { ScopeApi } from "./scope/api"; export { OAuthApi } from "./oauth/api"; export { PoliciesApi } from "./policies/api"; +export { + AccountApi, + AccountHttpApi, + AccountError, + AccountForbidden, + AccountNoOrganization, + AccountUnauthorized, +} from "./account/api"; diff --git a/packages/core/api/src/handlers/index.ts b/packages/core/api/src/handlers/index.ts index 1c0b608f0..06b5af670 100644 --- a/packages/core/api/src/handlers/index.ts +++ b/packages/core/api/src/handlers/index.ts @@ -26,6 +26,5 @@ export const CoreHandlers = Layer.mergeAll( ScopeHandlers, ExecutionsHandlers, OAuthHandlers, - OAuthHandlers, PoliciesHandlers, ); diff --git a/packages/core/api/src/index.ts b/packages/core/api/src/index.ts index 36af28026..6403d8d12 100644 --- a/packages/core/api/src/index.ts +++ b/packages/core/api/src/index.ts @@ -25,6 +25,32 @@ export { type RunOAuthCallbackInput, } from "./oauth-popup"; export { PoliciesApi } from "./policies/api"; +export { + AccountApi, + AccountHttpApi, + AccountError, + AccountForbidden, + AccountNoOrganization, + AccountUnauthorized, + AccountUser, + AccountOrganization, + AccountMeResponse, + ApiKeySummary, + ApiKeysResponse, + CreateApiKeyBody, + CreatedApiKeyResponse, + OrgMember, + OrgMemberSeats, + OrgMembersResponse, + OrgRole, + OrgRolesResponse, + InviteMemberBody, + InviteMemberResponse, + UpdateMemberRoleBody, + UpdateOrgNameBody, + UpdateOrgNameResponse, + SuccessResponse, +} from "./account/api"; export { InternalError, ErrorCapture, diff --git a/packages/core/api/src/server.ts b/packages/core/api/src/server.ts index a2ca278ca..b3cbb6ef3 100644 --- a/packages/core/api/src/server.ts +++ b/packages/core/api/src/server.ts @@ -14,3 +14,85 @@ export { providePluginExtensions, type PluginExtensionServices, } from "./plugin-routes"; +export { AccountProvider, type AccountProviderShape, type AccountHeaders } from "./account/service"; +export { AccountHandlers } from "./account/handlers"; +export { requestScopedMiddleware } from "./server/request-scoped"; +export { RouterConfigLive } from "./server/router-config"; +export { consoleErrorCapture } from "./server/console-error-capture"; +export { + makeExecutionStack, + CodeExecutorProvider, + EngineDecorator, + EngineDecoratorNoop, + type CodeExecutor, + type EngineDecoratorShape, + type EngineStackIdentity, +} from "./server/execution-stack"; +// Host-composition seams re-homed out of `@executor-js/sdk` (the plugin-author +// contract) into this host surface. The pure FumaDB assembly (`createExecutorFumaDb` +// + its types) keeps its definition in the SDK for the sqlite test backend and is +// re-exported here so hosts get the assembly AND the `DbProvider` seam from one +// place. `collectTables` keeps its definition in the SDK (it is part of +// `createExecutor`'s mechanics) and is re-exported here for hosts/tooling. +export { + createExecutorFumaDb, + dbProviderLayer, + DbProvider, + type CreateExecutorFumaDbOptions, + type ExecutorDbHandle, + type ExecutorDbProvider, + type ExecutorFumaDb, + type ExecutorFumaSchema, +} from "./server/executor-fuma-db"; +export { + makeScopedExecutor, + HostConfig, + PluginsProvider, + type HostConfigShape, + type PluginsProviderShape, +} from "./server/scoped-executor"; +export { collectTables } from "@executor-js/sdk"; +export { + IdentityProvider, + AuthContext, + Unauthorized, + NoOrganization, + Unavailable, + authContextFromPrincipal, + type Principal, + type IdentityProviderShape, + type IdentityFailure, +} from "./server/identity"; +export { + makeExecutionStackMiddleware, + textFailureStrategy, + type FailureRenderingStrategy, + type MakeExecutionStackMiddlewareOptions, +} from "./server/execution-stack-middleware"; +export { + makeFixedExecutionMiddleware, + FixedExecutionProvider, + type FixedExecution, + type MakeFixedExecutionMiddlewareOptions, +} from "./server/fixed-execution-middleware"; +export { + makeProtectedApiLayer, + makeAccountApiLayer, + accountProviderMiddlewareLayer, + toApiHandler, + type MakeProtectedApiLayerOptions, + type MakeAccountApiLayerOptions, + type ApiHandler, +} from "./server/host-foundation"; +export * as ExecutorApp from "./server/executor-app"; +export type { + ExecutorAppOptions, + AppProviders, + CommonProviders, + ScopedExecutionProviders, + FixedExecutionProviders, + AppExtensions, + AppConfig, + EngineProviders, + McpProviders, +} from "./server/executor-app"; diff --git a/packages/core/api/src/server/console-error-capture.ts b/packages/core/api/src/server/console-error-capture.ts new file mode 100644 index 000000000..1717ffe90 --- /dev/null +++ b/packages/core/api/src/server/console-error-capture.ts @@ -0,0 +1,39 @@ +// --------------------------------------------------------------------------- +// Console `ErrorCapture` factory. +// +// Prints the squashed + pretty-printed structured cause to stderr and returns +// a short correlation id that surfaces in the opaque 500 traceId, so operators +// can grep their logs/terminal scrollback when a user reports a traceId. Hosts +// that want richer reporting (cloud: Sentry) swap in their own adapter behind +// the same `ErrorCapture` tag. +// +// The `prefix` distinguishes which host emitted the id (e.g. `selfhost`, +// `local`). +// --------------------------------------------------------------------------- + +import { Cause, Effect, Layer } from "effect"; + +import { ErrorCapture } from "../observability"; + +export const consoleErrorCapture = (prefix: string): Layer.Layer => { + const nextTraceId = () => + `${prefix}-${Date.now().toString(36)}-${Math.random().toString(36).slice(2, 8)}`; + + return Layer.succeed( + ErrorCapture, + ErrorCapture.of({ + captureException: (cause) => + Effect.sync(() => { + const traceId = nextTraceId(); + const squashed = Cause.squash(cause); + console.error( + `[executor ${traceId}]`, + // oxlint-disable-next-line executor/no-instanceof-error -- boundary: console logger preserves native Error stack output + squashed instanceof Error ? (squashed.stack ?? squashed) : squashed, + ); + console.error(`[executor ${traceId}] cause:`, Cause.pretty(cause)); + return traceId; + }), + }), + ); +}; diff --git a/packages/core/api/src/server/execution-stack-middleware.ts b/packages/core/api/src/server/execution-stack-middleware.ts new file mode 100644 index 000000000..4173433f7 --- /dev/null +++ b/packages/core/api/src/server/execution-stack-middleware.ts @@ -0,0 +1,192 @@ +// --------------------------------------------------------------------------- +// Shared executor-API ExecutionStackMiddleware. +// +// Cloud and self-host had a structurally identical `HttpRouter` middleware that, +// per request: +// 1. reads the inbound `HttpServerRequest`, converts it to a web `Request`, +// 2. resolves identity (api-key/session for cloud, cookie/bearer/x-api-key for +// self-host) into a neutral `Principal`, +// 3. builds the per-(user, org) executor + engine via `makeExecutionStack`, +// 4. provides `AuthContext` + the execution-stack services + every plugin +// extension Service to the wrapped handler. +// +// This factory owns that common body. The differences are injected: +// - `authenticate` — the provider's resolve fn. BOTH apps yield the neutral +// `Principal` and fail the SHARED `Unauthorized | +// NoOrganization | Unavailable` (cloud: WorkOS api-key/ +// sealed-session; self-host: Better Auth cookie/bearer/ +// x-api-key). The credential precedence stays INSIDE each +// impl. +// - `renderFailure` — the failure-rendering strategy. Cloud renders the +// shared errors as its exact `{ error, code }` JSON at +// 401/403/503; self-host catches them into 401/403/503 +// text. The seam (request -> Principal | shared error) is +// identical; only the rendering differs. +// - `plugins` — the host's plugin tuple (typed extension Services). +// - `stackLayer` — the host's `makeExecutionStack` seam Layer (cloud: +// `CloudExecutionStackLayer`; self-host: +// `SelfHostExecutionStackLayer`). +// +// `LongLived` is the boot-scoped context captured at layer-build time (the +// provider tag + the stack's long-lived deps) so the per-request function only +// depends on `HttpRouter`-provided context. The returned value is the +// `HttpRouter.middleware` (NOT `.layer`) so a host can still `.combine(...)` a +// request-scoped middleware into it (cloud folds its per-request DB layer). +// --------------------------------------------------------------------------- + +import { HttpRouter, HttpServerRequest, HttpServerResponse } from "effect/unstable/http"; +import { Context, Effect, Layer } from "effect"; + +import type { AnyPlugin } from "@executor-js/sdk"; + +import type { DbProvider } from "./executor-fuma-db"; +import type { HostConfig, PluginsProvider } from "./scoped-executor"; +import { ExecutionEngineService, ExecutorService } from "../services"; +import { providePluginExtensions, type PluginExtensionServices } from "../plugin-routes"; +import { + authContextFromPrincipal, + AuthContext, + type IdentityFailure, + type Principal, +} from "./identity"; +import { + makeExecutionStack, + type CodeExecutorProvider, + type EngineDecorator, +} from "./execution-stack"; + +/** + * A failure-rendering strategy. `renderFailure` runs on the result of + * `authenticate`: it MUST either re-raise the failure (so a `Respondable` typed + * error reaches the framework's response pipeline — cloud) or recover it into a + * concrete `HttpServerResponse` (self-host's explicit 401/403 text). `RR` is the + * residual requirement the strategy adds (always `never` in practice). + */ +export interface FailureRenderingStrategy { + readonly renderFailure: ( + effect: Effect.Effect, + ) => Effect.Effect; +} + +/** + * Self-host's strategy: this is an `HttpRouter` middleware (not an `HttpApi` + * endpoint), so a failed typed error would surface as a 500 — recover + * `Unauthorized` -> 401 text and `NoOrganization` -> 403 text instead. Self-host + * never produces `Unavailable`, but the shared channel now includes it, so it is + * recovered to a 503 text for total coverage. + */ +export const textFailureStrategy: FailureRenderingStrategy = { + renderFailure: (effect) => + effect.pipe( + Effect.catchTags({ + Unauthorized: () => + Effect.succeed(HttpServerResponse.text("Unauthorized", { status: 401 })), + NoOrganization: () => + Effect.succeed( + HttpServerResponse.text("No organization for this account", { + status: 403, + }), + ), + Unavailable: () => + Effect.succeed( + HttpServerResponse.text("Authentication temporarily unavailable", { + status: 503, + }), + ), + }), + ), +}; + +export interface MakeExecutionStackMiddlewareOptions< + TPlugins extends readonly AnyPlugin[], + E, + RLong, + RStack, + RStrategy, +> { + /** The host's plugin tuple — drives the typed extension Services and binding. */ + readonly plugins: TPlugins; + /** + * Resolve the inbound web `Request` to a neutral `Principal`. Adapter-specific + * credential precedence stays inside this function. + */ + readonly authenticate: (request: Request) => Effect.Effect; + /** Render `authenticate` failures (passthrough for cloud, text for self-host). */ + readonly strategy: FailureRenderingStrategy; + /** The host's `makeExecutionStack` seam Layer. */ + readonly stackLayer: Layer.Layer< + DbProvider | PluginsProvider | HostConfig | CodeExecutorProvider | EngineDecorator, + never, + RStack + >; +} + +/** + * Build the shared `ExecutionStackMiddleware`. `RCapture` is the boot-scoped + * context captured ONCE at layer-build time; anything the per-request body still + * needs (`RLong | RStack | RStrategy` minus `RCapture`) stays a residual + * requirement of the returned middleware, satisfied per request by the host. + * + * - self-host captures everything (`AuthProvider | SelfHostDb`): no residual, + * so `.layer` is a complete Layer. + * - cloud captures only the boot-scoped services (its identity provider + the + * app-only billing service its metered stack reads) and leaves `DbService` + * residual, satisfied per request by `.combine(requestScopedMiddleware(rsLive))` + * (so the postgres.js socket lives in the request fiber's scope). + * + * The returned value is the `HttpRouter.middleware` (NOT `.layer`) so cloud can + * still `.combine(...)`. + */ +export const makeExecutionStackMiddleware = < + const TPlugins extends readonly AnyPlugin[], + E, + RLong = never, + RStack = never, + RStrategy = never, + RCapture = RLong | RStack | RStrategy, +>( + options: MakeExecutionStackMiddlewareOptions, +) => { + const provideExecutorExtensions = providePluginExtensions(options.plugins); + return HttpRouter.middleware<{ + provides: + | AuthContext + | ExecutorService + | ExecutionEngineService + | PluginExtensionServices; + }>()( + Effect.gen(function* () { + const captured = yield* Effect.context(); + return (httpEffect) => + Effect.gen(function* () { + const request = yield* HttpServerRequest.HttpServerRequest; + const webRequest = yield* HttpServerRequest.toWeb(request); + const resolved = yield* options.strategy.renderFailure(options.authenticate(webRequest)); + // The strategy recovered the failure into a Response — return it. + if (!isPrincipal(resolved)) return resolved; + const auth = AuthContext.of(authContextFromPrincipal(resolved)); + const { executor, engine } = yield* makeExecutionStack( + resolved.accountId, + resolved.organizationId, + resolved.organizationName, + ).pipe(Effect.provide(options.stackLayer)); + return yield* httpEffect.pipe( + Effect.provideService(AuthContext, auth), + Effect.provideService(ExecutorService, executor), + Effect.provideService(ExecutionEngineService, engine), + provideExecutorExtensions(executor), + ); + // Provide the boot-captured context; uncaptured deps (cloud's + // request-scoped `DbService`) remain residual and flow through here. + }).pipe(Effect.provideContext(captured as Context.Context)); + }), + ); +}; + +// `renderFailure` yields either the resolved `Principal` (proceed) or an +// already-built `HttpServerResponse` (the strategy recovered the failure). A +// `Principal` is a plain object with `accountId`; a response is tagged. Discern +// by the marker the response framework brands its values with. +const isPrincipal = ( + value: Principal | HttpServerResponse.HttpServerResponse, +): value is Principal => !HttpServerResponse.isHttpServerResponse(value); diff --git a/packages/core/api/src/server/execution-stack.ts b/packages/core/api/src/server/execution-stack.ts new file mode 100644 index 000000000..6e58801fc --- /dev/null +++ b/packages/core/api/src/server/execution-stack.ts @@ -0,0 +1,117 @@ +// --------------------------------------------------------------------------- +// Shared execution stack — turn a (user, org) into a runnable executor + engine. +// +// Cloud and self-host both had an identical `makeExecutionStack`: +// createScopedExecutor -> createExecutionEngine({ executor, codeExecutor }) -> +// { executor, engine } +// differing only in (a) the code substrate (cloud's Cloudflare dynamic-worker vs +// self-host's in-process QuickJS) and (b) cloud's usage-metering decorator +// (an app-only billing overlay), absent on self-host. +// +// This factory owns the common body. The two differences are injected: +// - `CodeExecutorProvider` — the `codeExecutor` value. Cloud's Layer wraps +// `makeDynamicWorkerExecutor({ loader: env.LOADER })`; self-host's wraps +// `makeQuickJsExecutor()`. +// - `EngineDecorator` — `decorate(engine) => engine`. Cloud's app layer applies +// a usage-metering overlay; the default Layer is a no-op (self-host, local, +// tests, and cloud's non-metering MCP session path). +// +// The per-(user, org) executor itself comes from `makeScopedExecutor` (sdk), +// which reads the DB handle / plugins / host config from its own seams. This +// lives in `@executor-js/api` because it is the only package that depends on +// both `@executor-js/sdk` (for `makeScopedExecutor`) and `@executor-js/execution` +// (for `createExecutionEngine`). +// --------------------------------------------------------------------------- + +import { Context, Effect, Layer } from "effect"; +import type * as Cause from "effect/Cause"; + +import type { AnyPlugin, Executor, StorageFailure } from "@executor-js/sdk"; +import { + createExecutionEngine, + type ExecutionEngine, + type ExecutionEngineConfig, +} from "@executor-js/execution"; + +import { DbProvider } from "./executor-fuma-db"; +import { HostConfig, PluginsProvider, makeScopedExecutor } from "./scoped-executor"; + +// --------------------------------------------------------------------------- +// CodeExecutorProvider seam — the host's code-execution substrate. Typed to the +// widened `Cause.YieldableError` channel (matching `ExecutionEngineService`) so +// a runtime-specific tagged error (DynamicWorkerExecutionError, QuickJS errors) +// assigns structurally. +// --------------------------------------------------------------------------- + +export type CodeExecutor = ExecutionEngineConfig["codeExecutor"]; + +export class CodeExecutorProvider extends Context.Service()( + "@executor-js/api/CodeExecutorProvider", +) {} + +// --------------------------------------------------------------------------- +// EngineDecorator seam — wrap the freshly built engine (e.g. with usage +// metering). `decorate` receives the same `(accountId, organizationId, +// organizationName)` identity the stack was built for, so a host can bind the +// decorator to the org (cloud's per-org usage metering needs the org id). The +// default Layer is a no-op so hosts that do not decorate (self-host, local, +// tests) get an identity transform for free. +// --------------------------------------------------------------------------- + +export interface EngineStackIdentity { + readonly accountId: string; + readonly organizationId: string; + readonly organizationName: string; +} + +export interface EngineDecoratorShape { + readonly decorate: ( + engine: ExecutionEngine, + identity: EngineStackIdentity, + ) => ExecutionEngine; +} + +export class EngineDecorator extends Context.Service()( + "@executor-js/api/EngineDecorator", +) {} + +/** No-op decorator: the engine passes through unchanged. */ +export const EngineDecoratorNoop: Layer.Layer = Layer.succeed(EngineDecorator)({ + decorate: (engine) => engine, +}); + +// --------------------------------------------------------------------------- +// makeExecutionStack — shared (user, org) -> { executor, engine }. +// +// Reads `makeScopedExecutor` (sdk), the code substrate from +// `CodeExecutorProvider`, and the engine wrap from `EngineDecorator`. The +// returned engine error channel is widened to `Cause.YieldableError`, matching +// `ExecutionEngineService` and the runtime-specific code executors. +// --------------------------------------------------------------------------- + +export const makeExecutionStack = < + const TPlugins extends readonly AnyPlugin[] = readonly AnyPlugin[], +>( + accountId: string, + organizationId: string, + organizationName: string, +): Effect.Effect< + { readonly executor: Executor; readonly engine: ExecutionEngine }, + StorageFailure, + DbProvider | PluginsProvider | HostConfig | CodeExecutorProvider | EngineDecorator +> => + Effect.gen(function* () { + const executor = yield* makeScopedExecutor( + accountId, + organizationId, + organizationName, + ); + const codeExecutor = yield* CodeExecutorProvider; + const { decorate } = yield* EngineDecorator; + const engine = decorate(createExecutionEngine({ executor, codeExecutor }), { + accountId, + organizationId, + organizationName, + }); + return { executor, engine }; + }); diff --git a/packages/core/api/src/server/executor-app.ts b/packages/core/api/src/server/executor-app.ts new file mode 100644 index 000000000..622412df2 --- /dev/null +++ b/packages/core/api/src/server/executor-app.ts @@ -0,0 +1,594 @@ +// --------------------------------------------------------------------------- +// ExecutorApp.make — the single composition facade every product host calls. +// +// One codebase, three scenarios: cloud / self-host / local are the SAME code +// paths; the difference is a list of injected Layers. `ExecutorApp.make` is the +// shared assembly those Layers slot into — a newcomer reads ONE `make({ … })` +// call and sees the whole scenario (which identity, which DB, which code +// substrate, which MCP, billing present or absent). +// +// It does exactly what each host's hand-rolled composition root did before: +// +// 1. execution stack Layer = db + engine.codeExecutor + engine.decorator +// + plugins.provider + plugins.config (the makeExecutionStack seams) +// 2. ExecutionStackMiddleware = makeExecutionStackMiddleware(identity-authenticate +// + that stack + plugin tuple + failure strategy) (auth + per-request executor) +// 3. the protected (plugin) API = makeProtectedApiLayer(plugins, { errorCapture, +// router: prefixed(mountPrefix) }) wrapped by (2) +// 4. the MCP serving envelope = McpServingRoutes + the 2-3 seams (auth/sessions +// /reporter), double-provided like the host did (the seams) +// 5. the account API = makeAccountApiLayer(accountMiddleware, { router }) +// 6. each extensions.route (Better Auth handler, Swagger, marketing, /autumn) +// 7. provideMerge(boot) (+ optional requestScoped) -> the AppLayer +// 8. toApiHandler(appLayer) -> { handler, dispose } (web-handler binding) +// +// SEAM vs EXTENSION (the grouping teaches the line): +// - `providers.*` = named slots whose Layer satisfies a tag the shared core +// RESOLVES (identity, account, db, engine, mcp, plugins, +// errorCapture). The app picks the impl; the core names the +// tag. `errorCapture` IS a seam — the core resolves it. +// - `extensions.*` = surface the core never names (routes/services). Better +// Auth's /api/auth handler, Swagger, cloud's marketing + +// /autumn billing live here. The shared core never imports +// them. +// +// `mountPrefix` is a STRING ("/api"); make() builds the `router.prefixed(...)` +// view internally so a host never hand-writes path stripping. `mcpExport` is the +// escape hatch for a platform-only export (cloud's Durable Object class) that the +// runtime needs surfaced but the shared core never names — make() passes it back +// out untouched. +// --------------------------------------------------------------------------- + +import { HttpRouter } from "effect/unstable/http"; +import { Effect, Layer } from "effect"; + +import type { AnyPlugin } from "@executor-js/sdk"; +import type { DbProvider } from "./executor-fuma-db"; +import type { HostConfig, PluginsProvider } from "./scoped-executor"; +import { requestScopedMiddleware } from "./request-scoped"; +import { + McpServingRoutes, + McpErrorReporterNoop, + type McpAuthProvider, + type McpErrorReporter, + type McpSessionStore, +} from "@executor-js/host-mcp"; + +import { composePluginApi } from "../plugin-routes"; +import type { ErrorCapture } from "../observability"; +import { + EngineDecoratorNoop, + type CodeExecutorProvider, + type EngineDecorator, +} from "./execution-stack"; +import { + makeExecutionStackMiddleware, + type FailureRenderingStrategy, +} from "./execution-stack-middleware"; +import { makeFixedExecutionMiddleware, FixedExecutionProvider } from "./fixed-execution-middleware"; +import { IdentityProvider, type IdentityFailure, type Principal } from "./identity"; +import { + makeAccountApiLayer, + makeProtectedApiLayer, + toApiHandler, + type ApiHandler, +} from "./host-foundation"; + +// A fully-resolved route/app Layer with its channels erased. Used at the +// assembly boundaries (mirrors `toApiHandler`'s loose typing): each host's +// composed set differs (account API present or not, MCP present or not, the +// residual `RDb`/`RAcct` flow varies), but at runtime every requirement is +// provided. Keeping the boundary loose avoids leaking the constrained plugin +// handler-error union into every assembled host layer. +// +// `Layer` — `ROut` is CONTRAVARIANT, so `never` (not +// `any`) is the universal supertype in that slot: every concrete route layer is +// assignable to `Layer`. +// eslint-disable-next-line @typescript-eslint/no-explicit-any +type AppRouteLayer = Layer.Layer; + +// --------------------------------------------------------------------------- +// Provider seams — the variation points the shared core resolves. +// --------------------------------------------------------------------------- + +/** + * The execution engine seams: the code substrate + the optional decorator. The + * code executor varies per host (QuickJS in-process vs the Cloudflare dynamic + * worker); the decorator wraps the engine for app-only concerns (cloud's usage + * metering) and defaults to the no-op when absent. + * + * This is the SCOPED execution model: the `ExecutionStackMiddleware` builds a + * fresh per-(user, org) executor each request via `makeExecutionStack`. Cloud + * and self-host use it. A host whose executor is a single boot-built instance + * (local) supplies `providers.fixedExecution` instead — see `AppProviders`. + */ +export interface EngineProviders { + /** The code-execution substrate (QuickJS, dynamic worker, …). */ + readonly codeExecutor: Layer.Layer; + /** + * Wraps the built engine; defaults to `EngineDecoratorNoop` (no metering). May + * carry a boot-scoped residual `REngine` (cloud's metering decorator reads the + * `AutumnService` shell), folded into `RDb` and satisfied by `boot`. + */ + readonly decorator?: Layer.Layer; +} + +/** + * The MCP serving seams. Omit the whole group to serve no `/mcp` envelope. The + * reporter defaults to the no-op. + * + * `RMcpAuth` is the auth seam's residual requirement (default `never`). The + * facade ALWAYS provides `providers.identity` to it (a harmless no-op when the + * seam ignores it), so a host whose MCP auth genuinely reads the neutral + * identity fallback sets `RMcpAuth = IdentityProvider` (self-host) and one whose + * MCP plane is a separate credential surface leaves it `never` (cloud). + */ +export interface McpProviders { + /** Resolve a request to an MCP `AuthOutcome` + declare the discovery routes. */ + readonly auth: Layer.Layer; + /** Owns the entire serving-session lifecycle (in-process Map vs DO). */ + readonly sessions: Layer.Layer; + /** Forward an orchestration defect to the host's capture; default no-op. */ + readonly reporter?: Layer.Layer; +} + +/** + * The provider seams common to BOTH execution models (scoped + fixed): identity, + * the optional account API, the optional MCP envelope, and error capture. The + * execution-specific seams live on the two variant interfaces below. + */ +export interface CommonProviders { + /** + * The neutral `IdentityProvider` seam Layer. EVERY host provides the SAME tag: + * self-host's Better Auth layer, cloud's `workosIdentityLayer`, and local's + * single-user provider are implementations of one seam. The facade ALWAYS + * builds the `authenticate` resolver by reading this tag, so a host never + * hand-writes one. + * + * `RIdentity` is the layer's own residual requirement (cloud's per-request + * `UserStoreService`/`DbService`; `never` for self-host and local). The facade + * provides this layer PER REQUEST over `requestScoped` (which carries + * `RIdentity`), so the resolver runs in the request fiber where the identity + * layer's deps (the postgres socket) live. A `RIdentity = never` layer is + * provided directly with no per-request dependency. + */ + readonly identity: Layer.Layer; + /** + * The account-API middleware Layer (provides `AccountProvider` per request via + * a `Request<"Requires", AccountProvider>` marker). Omit to serve no account + * API (self-contained / local). `RAcct` is its residual requirement, satisfied + * by `boot` / `requestScoped`. The output is left open (`ROut` is + * contravariant, so `never` accepts any middleware-marker layer). + */ + readonly account?: Layer.Layer; + /** The MCP serving seams; omit to serve no `/mcp` envelope. */ + readonly mcp?: McpProviders; + /** The `ErrorCapture` seam (console vs Sentry) — the core resolves it. */ + readonly errorCapture: Layer.Layer; +} + +/** + * The SCOPED execution provider seams (cloud + self-host): a per-request + * executor is built from the resolved `Principal` over the DB handle, the plugin + * data seams, and the engine substrate. `RDb` is the boot-scoped residual these + * seams leave (self-host's long-lived `SelfHostDb` handle, cloud's metering + * decorator's `AutumnService`), satisfied by `boot`. + */ +export interface ScopedExecutionProviders { + /** The `DbProvider` seam (may require `boot`'s long-lived handle). */ + readonly db: Layer.Layer; + /** + * The code-execution engine seams. The optional decorator may carry a + * boot-scoped residual (cloud's metering decorator's `AutumnService`), folded + * into `RDb`. + */ + readonly engine: EngineProviders; + /** The plugin data seams (PluginsProvider + HostConfig). */ + readonly plugins: { + readonly provider: Layer.Layer; + readonly config: Layer.Layer; + }; + /** Distinct from the fixed shape — never set here. */ + readonly fixedExecution?: undefined; +} + +/** + * The FIXED execution provider seam (local): the host builds ONE executor + + * engine at boot (single cwd scope + `allowHttp`) and shares it across every + * request. No per-request scope-stack rebuild, no `DbProvider`/`PluginsProvider`/ + * `HostConfig`/`CodeExecutorProvider` seams (the executor already holds its db, + * plugins, and code substrate). The facade still runs the identity seam per + * request to build `AuthContext`, then provides this constant executor/engine. + */ +export interface FixedExecutionProviders { + /** The boot-built executor + engine + plugin extension map, as one seam. */ + readonly fixedExecution: Layer.Layer; + /** Distinct from the scoped shape — never set here. */ + readonly db?: undefined; + readonly engine?: undefined; + readonly plugins?: undefined; +} + +/** + * Every provider seam, grouped. The execution model is a discriminated union: + * `ScopedExecutionProviders` (cloud + self-host: per-request scoped executor) or + * `FixedExecutionProviders` (local: one boot executor). `RAcct` is the account + * middleware's residual; `RIdentity` the identity seam's own residual; `RMcpAuth` + * the MCP auth seam's residual. + */ +export type AppProviders = CommonProviders< + RAcct, + RIdentity, + RMcpAuth +> & + (ScopedExecutionProviders | FixedExecutionProviders); + +// --------------------------------------------------------------------------- +// Extensions — app-only surface the core never names. +// --------------------------------------------------------------------------- + +/** + * A route extension Layer: registers on the ambient (un-prefixed) `HttpRouter`. + * The requirement channel is left open (`RIn` is covariant) because a route + * handler may carry framework markers — `HttpRouter.HttpRouter` plus, e.g., a + * `Request<"Error", HttpServerError>` marker from `HttpEffect.fromWebHandler` — + * that the serve binding clears. Provides nothing of its own. + */ +// eslint-disable-next-line @typescript-eslint/no-explicit-any +export type RouteExtension = Layer.Layer; + +/** + * App-only HTTP surface mounted alongside the API: each entry registers on the + * ambient (un-prefixed) `HttpRouter`. Better Auth's `/api/auth/*` handler, + * Swagger, cloud's marketing + `/autumn` billing route all live here — the + * shared core never imports them. + */ +export interface AppExtensions { + /** Extra route Layers to merge into the app router. */ + readonly routes?: ReadonlyArray; +} + +// --------------------------------------------------------------------------- +// Config +// --------------------------------------------------------------------------- + +// The identity seam's failure channel (`Unauthorized | NoOrganization | +// Unavailable`) lives in `./identity` now that BOTH apps provide the neutral +// `IdentityProvider`. The failure strategy renders it: self-host catches it into +// 401/403/503 text (`textFailureStrategy`; it never produces `Unavailable`); +// cloud's strategy renders its exact 401/403/503 `{ error, code }` JSON bytes. +export type { IdentityFailure }; + +export interface AppConfig { + /** + * Serve the typed API under this path prefix ("/api"). make() builds the + * `router.prefixed(mountPrefix)` view internally; omit to serve at root. + */ + readonly mountPrefix?: `/${string}`; + /** + * How identity-resolution failures render. The facade builds `authenticate` + * from the `IdentityProvider` tag, so the failure channel is always the shared + * `IdentityFailure`: cloud renders its `{ error, code }` JSON, self-host 401/403 + * text. + */ + readonly failure: FailureRenderingStrategy; + /** + * Escape hatch for a platform-only export the runtime needs surfaced but the + * shared core never names (cloud's MCP session Durable Object class). make() + * passes it back out on the result untouched. + */ + readonly mcpExport?: McpExport; +} + +// --------------------------------------------------------------------------- +// make +// --------------------------------------------------------------------------- + +export interface ExecutorAppOptions< + TPlugins extends readonly AnyPlugin[], + RDb, + RAcct, + RStrategy, + RBoot, + RReq, + McpExport, + RIdentity = never, + RMcpAuth = never, +> { + /** The host's plugin tuple (drives the API + per-request extension Services). */ + readonly plugins: TPlugins; + /** The provider seams (variation points the core resolves). */ + readonly providers: AppProviders; + /** App-only surface the core never names (routes). */ + readonly extensions?: AppExtensions; + /** Mount prefix + failure strategy + the platform-only export escape hatch. */ + readonly config: AppConfig; + /** + * The boot-scoped Layer `provideMerge`'d under everything (the long-lived DB + * handle, the resolved identity, the router config). Satisfies the residual + * `RDb | RAcct` left by the seams. + */ + readonly boot: Layer.Layer; + /** Optional per-request Layer (cloud's request-scoped postgres socket). */ + readonly requestScoped?: Layer.Layer; +} + +export interface ExecutorApp { + /** + * The composed plugin `HttpApi` value. Reused by the host for Swagger/OpenAPI, + * `.prefix(...)` spec views, and clients — the SAME spec `make` mounts, so a + * host's Swagger extension never diverges from the served routes. + */ + readonly api: ReturnType>; + /** + * The fully-assembled, platform-agnostic app `Layer` (every route requirement + * provided). Typed loosely for the same reason `toApiHandler` is — each host's + * resolved channels differ — but at runtime every requirement is satisfied. + * The self-host Bun server (`serve.ts`) and cloud Workers both bind this shape. + */ + readonly appLayer: AppRouteLayer; + /** Bind `appLayer` to a `fetch`-style web handler (tests + Workers). */ + readonly toWebHandler: () => ApiHandler; + /** The platform-only export passed through from `config.mcpExport` (cloud's DO class). */ + readonly mcpExport: McpExport; +} + +/** + * Assemble the shared Executor HTTP app from a host's provider seams + + * extensions. Returns the platform-agnostic `appLayer` (the self-host Bun server + * + cloud Workers both bind this one shape), a `toWebHandler` binding (tests), + * and the pass-through `mcpExport`. + * + * Internally a faithful reproduction of every host's prior composition root: the + * execution-stack middleware wrapping the protected API, the MCP envelope's + * double-provide (build-time auth + per-request seams), the account API on the + * same prefixed router, the extension routes, and `provideMerge(boot)`. + */ +export const make = < + const TPlugins extends readonly AnyPlugin[], + RDb, + RAcct, + RStrategy, + RBoot, + RReq = never, + McpExport = undefined, + RIdentity = never, + RMcpAuth = never, +>( + options: ExecutorAppOptions< + TPlugins, + RDb, + RAcct, + RStrategy, + RBoot, + RReq, + McpExport, + RIdentity, + RMcpAuth + >, +): ExecutorApp => { + const { plugins, providers, config } = options; + + // The execution model is a discriminated union (see `AppProviders`): a host + // either supplies the SCOPED seams (db + plugins + engine -> a fresh + // per-(user, org) executor each request) or a single FIXED executor built once + // at boot (local). `fixedExecution` present on `providers` selects the latter. + const fixedExecution = providers.fixedExecution; + + // ---- a `mountPrefix`-prefixed view of the ambient router --------------- + // Providing it to the API builders makes every API/account route serve under + // the prefix (the router slices it before matching; no hand-written + // stripping). Omitted -> the ambient root router is used. + const prefix = config.mountPrefix; + const prefixedRouter = prefix + ? Layer.effect(HttpRouter.HttpRouter)( + Effect.map(HttpRouter.HttpRouter.asEffect(), (router) => router.prefixed(prefix)), + ) + : undefined; + + // ---- (2) the ExecutionStackMiddleware --------------------------------- + // The identity seam authenticates; the failure strategy renders; the stack + // Layer + plugin tuple build the per-request executor. The facade ALWAYS builds + // the resolver by reading the neutral `IdentityProvider` tag — no host hand- + // writes one. Where the tag is satisfied is the only difference: self-host's + // identity layer is boot-scoped (in `boot`, captured below), cloud's reads a + // PER-REQUEST `UserStoreService`, so the facade folds the identity layer over + // `requestScoped` into this middleware (see `requestScopedIdentity` below) and + // the tag is resolved in the request fiber. Both fail the shared + // `Unauthorized | NoOrganization | Unavailable`. + const authenticate = ( + request: Request, + ): Effect.Effect => + Effect.flatMap(IdentityProvider.asEffect(), (provider) => provider.authenticate(request)); + + // The per-request layer combined into the middleware: cloud's `requestScoped` + // (the postgres socket) with `providers.identity` PROVIDE-MERGEd over it, so the + // identity layer is rebuilt per request in the same fiber scope as the socket it + // reads (Cloudflare Workers' I/O isolation) — `RIdentity` (cloud's + // `UserStoreService`) is satisfied by `requestScoped`, leaving the combined layer + // residual-free. Self-host omits `requestScoped` -> no per-request layer; its + // `IdentityProvider` (`RIdentity = never`) is boot-scoped in `boot`. + // The combined layer provides `IdentityProvider | RReq` and is residual-free in + // practice: a host that supplies `requestScoped` guarantees its `RReq` covers the + // identity layer's `RIdentity` (cloud's `RequestScopedServicesLive` provides the + // `UserStoreService`/`DbService` `workosIdentityLayer` reads). TS cannot reduce + // `Exclude` for abstract params, so widen to the complete shape. + const requestScopedIdentity = options.requestScoped + ? (providers.identity.pipe(Layer.provideMerge(options.requestScoped)) as Layer.Layer< + IdentityProvider | RReq + >) + : undefined; + + // The execution middleware, per model. SCOPED: build a fresh per-(user, org) + // executor each request from the resolved `Principal` over the stack seams. + // FIXED: resolve the `Principal` (-> `AuthContext`) but provide the single boot + // executor captured from `boot` (local). Both read the SAME `authenticate` + // resolver and failure strategy — only the executor lifetime differs. + // + // `RCapture` is the boot-scoped context captured ONCE at layer-build time. The + // per-request `IdentityProvider | RReq` is EXCLUDED so the resolver's identity + // layer + the stack's per-request deps stay residual, supplied per request by + // `requestScopedIdentity` folded into the middleware below. Self-host has no + // `requestScoped`, so its `IdentityProvider` + everything (`RDb | RStrategy`) is + // captured from `boot` — its prior behavior. + const executionMiddleware = fixedExecution + ? makeFixedExecutionMiddleware< + TPlugins, + IdentityFailure, + IdentityProvider, + RStrategy, + // Fixed mode has no `requestScoped`: the identity layer + the + // `FixedExecutionProvider` + the strategy are all boot-scoped (in `boot`), + // so the whole capture context flows there. + IdentityProvider | RStrategy | FixedExecutionProvider + >({ + plugins, + authenticate, + strategy: config.failure, + }) + : makeExecutionStackMiddleware< + TPlugins, + IdentityFailure, + IdentityProvider, + RDb, + RStrategy, + Exclude + >({ + plugins, + authenticate, + strategy: config.failure, + // db + plugins.provider + plugins.config + engine.codeExecutor + + // engine.decorator (default no-op). The merged Layer leaves the + // boot-scoped `RDb` residual, satisfied by `boot` below. + stackLayer: Layer.mergeAll( + providers.db, + providers.plugins.provider, + providers.plugins.config, + providers.engine.codeExecutor, + providers.engine.decorator ?? EngineDecoratorNoop, + ) as Layer.Layer< + DbProvider | PluginsProvider | HostConfig | CodeExecutorProvider | EngineDecorator, + never, + RDb + >, + }); + + // ---- (3) the protected (plugin) API, wrapped by the middleware --------- + const protectedApi = makeProtectedApiLayer(plugins, { + errorCapture: providers.errorCapture, + router: prefixedRouter, + }); + // The plugin handler Layers stay late-binding (each requires its plugin's + // `*ExtensionService` Tag), satisfied by the execution middleware here. + // Erased to the loose route-layer shape (matching `toApiHandler`): the + // assembled channels differ per host but every requirement is provided. + // + // `requestScopedIdentity` (cloud's per-request postgres socket + the identity + // layer rebuilt over it) is `.combine`'d INTO the execution middleware so it is + // rebuilt per HTTP request — `requestScopedMiddleware` runs `Layer.build` + // inside the per-request fiber's scope (Cloudflare Workers' I/O isolation forbids + // sharing a socket across requests). Combining drops the resolver's per-request + // `IdentityProvider` (resolved over the socket) and the stack's `DbService` from + // the middleware's `requires`. Self-host + local omit `requestScoped` -> the + // plain middleware `.layer`, whose residual `IdentityProvider` (and, for fixed, + // `FixedExecutionProvider`) flows to boot-scoped `boot`. + const middlewareLayer = ( + requestScopedIdentity + ? executionMiddleware.combine(requestScopedMiddleware(requestScopedIdentity)) + : executionMiddleware + ).layer as AppRouteLayer; + const pluginApiLive = protectedApi.layer.pipe(Layer.provide(middlewareLayer)) as AppRouteLayer; + + // ---- (5) the account API (optional) ----------------------------------- + // The account middleware provides `AccountProvider` per request; its residual + // `RAcct` (cloud's control-plane services; `never` for self-host) flows through + // to `boot`. Omit `providers.account` -> no account API (the test-stub path). + const apiLive: AppRouteLayer = providers.account + ? Layer.merge( + pluginApiLive, + makeAccountApiLayer( + providers.account as Layer.Layer, + prefixedRouter ? { router: prefixedRouter } : {}, + ) as AppRouteLayer, + ) + : pluginApiLive; + + // ---- (4) the MCP serving envelope (optional) -------------------------- + // The two providers, by design (mirrors makeSelfHostMcp): + // - `Layer.provide(mcpAuth)` satisfies the `HttpRouter.use` callback's + // build-time `McpAuthProvider` requirement (it registers a GET per + // provider-declared discovery path). + // - `HttpRouter.provideRequest(McpSeams)` clears the route handlers' + // per-request `Requires` markers (auth + session store + reporter) so the + // /mcp routes carry no leftover requirements when merged into the router. + // The auth seam may require the neutral `IdentityProvider` (`RMcpAuth = + // IdentityProvider` for self-host, whose MCP auth genuinely reads the fallback; + // `never` for cloud, whose MCP plane is a separate credential surface). The + // facade provides the identity seam to mcp.auth either way (a no-op when the + // seam ignores it). `RIdentity` (cloud's `UserStoreService`) is satisfied by + // `requestScoped`, so the MCP identity layer is a COMPLETE `Layer` + // even though cloud's MCP path never invokes it (the socket is never opened). + const mcpIdentity = ( + options.requestScoped + ? providers.identity.pipe(Layer.provide(options.requestScoped)) + : providers.identity + ) as Layer.Layer; + const mcpRouteLive = providers.mcp ? buildMcpRoutes(providers.mcp, mcpIdentity) : undefined; + + // ---- (6) extension routes (Better Auth handler, Swagger, …) ----------- + const extensionRoutes = options.extensions?.routes ?? []; + + // ---- (7) provideMerge(boot) -> the AppLayer --------------------------- + // `provideMerge(boot)` resolves the seams' residual requirements (the + // long-lived DB handle, the control-plane services); the runtime contract is + // the same — every route requirement is provided. + const routeLayers: AppRouteLayer[] = [apiLive]; + if (mcpRouteLive) routeLayers.push(mcpRouteLive); + for (const route of extensionRoutes) routeLayers.push(route); + + const merged = Layer.mergeAll(routeLayers[0], ...routeLayers.slice(1)); + + // `requestScoped` is NOT merged into `boot` — that would build the per-request + // socket ONCE at boot. It is folded into the execution-stack middleware (above) + // and into the account middleware + extension routes (the host self-combines + // those) so each rebuilds per request. `boot` is the long-lived context. + const appLayer: AppRouteLayer = merged.pipe(Layer.provideMerge(options.boot)); + + return { + api: protectedApi.api, + appLayer, + // `toApiHandler` takes the (covariant-on-output) loose `Layer`; our + // `AppRouteLayer` uses `never` in the contravariant output slot, so widen. + // eslint-disable-next-line @typescript-eslint/no-explicit-any + toWebHandler: () => toApiHandler(appLayer as Layer.Layer), + mcpExport: config.mcpExport as McpExport, + }; +}; + +/** + * Compose the MCP serving routes over the auth/sessions/reporter seams. The auth + * seam may require the neutral `IdentityProvider` (`RMcpAuth`); the facade provides + * the complete identity seam ONCE (memoized) and shares it across the build-time + * `Layer.provide` AND the per-request `HttpRouter.provideRequest`, so a single + * identity resolution serves both. When the auth seam ignores identity + * (`RMcpAuth = never`, cloud), the provide is a harmless no-op. + */ +const buildMcpRoutes = ( + mcp: McpProviders, + identity: Layer.Layer, +): Layer.Layer => { + // The auth seam may declare `IdentityProvider` as a requirement (self-host's + // genuinely reads it; cloud's ignores it — its MCP JWT/api-key path is separate). + // Either way the identity seam is provided ONCE (memoized) and shared across the + // build-time provide + the per-request `provideRequest`. The provided + // `IdentityProvider` covers `RMcpAuth` whether it is `IdentityProvider` or `never`. + const mcpAuthLive = (mcp.auth as Layer.Layer).pipe( + Layer.provide(identity), + ); + const mcpSeams = Layer.mergeAll(mcpAuthLive, mcp.sessions, mcp.reporter ?? McpErrorReporterNoop); + return McpServingRoutes.pipe(HttpRouter.provideRequest(mcpSeams), Layer.provide(mcpAuthLive)); +}; + +// Re-exported so a strategy author building the `config.failure` value can name +// the `Principal` the strategy renders failures around. +export type { Principal }; diff --git a/packages/core/api/src/server/executor-fuma-db.ts b/packages/core/api/src/server/executor-fuma-db.ts new file mode 100644 index 000000000..562b1fea4 --- /dev/null +++ b/packages/core/api/src/server/executor-fuma-db.ts @@ -0,0 +1,51 @@ +// --------------------------------------------------------------------------- +// The DbProvider seam — host-composition over the shared FumaDB assembly. +// +// `DbProvider` is the Effect seam P3's `makeScopedExecutor` reads the handle +// from. Each app provides a Layer wrapping its existing connection + +// schema-ensure strategy; the handle shape is uniform (`{ db, fuma, close }`) +// while the bring-up impl stays per-provider. +// +// The pure assembly (`createExecutorFumaDb` + its types) lives in the SDK +// because the SDK's own sqlite test backend shares it; it is re-exported from +// `@executor-js/api/server` so hosts import the assembly AND the seam from one +// host surface. This module owns only the host-composition seam. +// --------------------------------------------------------------------------- + +import { Context, Effect, Layer } from "effect"; + +import type { ExecutorDbHandle } from "@executor-js/sdk/host-internal"; + +// Re-export the pure FumaDB assembly + its types from the SDK so hosts get the +// whole DB surface from one place (`@executor-js/api/server`). +export { + createExecutorFumaDb, + type CreateExecutorFumaDbOptions, + type ExecutorDbHandle, + type ExecutorDbProvider, + type ExecutorFumaDb, + type ExecutorFumaSchema, +} from "@executor-js/sdk/host-internal"; + +/** + * The injection point for the executor's FumaDB handle. P3's + * `makeScopedExecutor` reads `db` from here. Each app supplies a Layer wrapping + * its existing driver-open + schema-ensure; the bring-up strategy stays + * per-provider. + */ +export class DbProvider extends Context.Service()( + "@executor-js/sdk/DbProvider", +) {} + +/** + * Build a scoped `DbProvider` Layer from an acquire that opens the host's + * driver and assembles the handle (typically by calling `createExecutorFumaDb` + * after its own driver-open + schema bring-up). The handle's `close` runs on + * scope teardown. + */ +export const dbProviderLayer = ( + acquire: Effect.Effect, +): Layer.Layer => + Layer.effect(DbProvider)( + Effect.acquireRelease(acquire, (handle) => Effect.promise(() => handle.close())), + ); diff --git a/packages/core/api/src/server/fixed-execution-middleware.ts b/packages/core/api/src/server/fixed-execution-middleware.ts new file mode 100644 index 000000000..a284c2d3e --- /dev/null +++ b/packages/core/api/src/server/fixed-execution-middleware.ts @@ -0,0 +1,130 @@ +// --------------------------------------------------------------------------- +// Fixed-executor ExecutionStackMiddleware — the single-scope, boot-built +// execution variant of `./execution-stack-middleware.ts`. +// +// The per-request `ExecutionStackMiddleware` resolves a `Principal` and then +// builds a FRESH per-(user, org) executor each request via `makeExecutionStack` +// -> `makeScopedExecutor` -> `makeUserOrgScopeStack(accountId, organizationId, +// organizationName)`. That is the cloud / self-host model: a 2-level +// `[user-org:…, org]` scope stack derived from identity. +// +// Local is structurally different: ONE executor is built once at boot over a +// SINGLE scope derived from the working directory (`-`), with +// `oauthEndpointUrlPolicy: { allowHttp: true }`, and shared across every request +// (and the in-process MCP). There is no (user, org) and no per-request scope. +// Forcing local through the scope-stack middleware would (a) swap its cwd scope +// for a synthetic `user-org:` scope key — orphaning existing `~/.executor` data +// — and (b) silently drop `allowHttp`. +// +// So a host whose execution is a single boot executor supplies a +// `FixedExecutionProvider` (the pre-built executor + engine) and this middleware +// resolves identity to `AuthContext` exactly like the scoped variant, then +// provides the FIXED executor + engine + plugin extension Services to the +// handler — no per-request rebuild. The identity seam still runs (so a host can +// gate or attribute requests), but the executor is constant. This is local's +// genuine model expressed as a first-class `make()` execution mode, not a +// special case bolted onto the scoped path. +// --------------------------------------------------------------------------- + +import { HttpRouter, HttpServerRequest, HttpServerResponse } from "effect/unstable/http"; +import { Context, Effect } from "effect"; +import type * as Cause from "effect/Cause"; + +import type { AnyPlugin, Executor, PluginExtensions } from "@executor-js/sdk"; +import type { ExecutionEngine } from "@executor-js/execution"; + +import { ExecutionEngineService, ExecutorService } from "../services"; +import { providePluginExtensions, type PluginExtensionServices } from "../plugin-routes"; +import { authContextFromPrincipal, AuthContext, type Principal } from "./identity"; +import type { FailureRenderingStrategy } from "./execution-stack-middleware"; + +/** + * The pre-built, boot-scoped execution a fixed-executor host serves on. Local + * builds this ONCE (single cwd scope + `allowHttp`) and shares it across every + * request and the in-process MCP. `extensions` is the plugin extension map + * (`executor[pluginId]`) the handlers' `*ExtensionService` Tags read. + */ +export interface FixedExecution { + readonly executor: Executor; + readonly engine: ExecutionEngine; + readonly extensions: PluginExtensions; +} + +export class FixedExecutionProvider extends Context.Service< + FixedExecutionProvider, + FixedExecution +>()("@executor-js/api/FixedExecutionProvider") {} + +export interface MakeFixedExecutionMiddlewareOptions< + TPlugins extends readonly AnyPlugin[], + E, + RLong, + RStrategy, +> { + /** The host's plugin tuple — drives the typed extension Services and binding. */ + readonly plugins: TPlugins; + /** + * Resolve the inbound web `Request` to a neutral `Principal`. The credential + * shape stays inside this function; local's single-user provider always + * resolves the one local Principal. + */ + readonly authenticate: (request: Request) => Effect.Effect; + /** Render `authenticate` failures (text for local, matching self-host). */ + readonly strategy: FailureRenderingStrategy; +} + +/** + * Build the fixed-executor `ExecutionStackMiddleware`. Per request: resolve the + * `Principal` (and render any failure), build the `AuthContext`, then provide + * the boot-built `FixedExecutionProvider`'s executor + engine + plugin extension + * Services to the wrapped handler. `RCapture` is the boot-scoped context + * captured once at layer-build time (the identity provider + the fixed execution + * seam); the per-request body depends only on `HttpRouter`-provided context. + * + * Returned as the `HttpRouter.middleware` value (NOT `.layer`) so it composes + * the same way the scoped variant does. + */ +export const makeFixedExecutionMiddleware = < + const TPlugins extends readonly AnyPlugin[], + E, + RLong = never, + RStrategy = never, + RCapture = RLong | RStrategy | FixedExecutionProvider, +>( + options: MakeFixedExecutionMiddlewareOptions, +) => { + const provideExecutorExtensions = providePluginExtensions(options.plugins); + return HttpRouter.middleware<{ + provides: + | AuthContext + | ExecutorService + | ExecutionEngineService + | PluginExtensionServices; + }>()( + Effect.gen(function* () { + const captured = yield* Effect.context(); + const { executor, engine, extensions } = yield* FixedExecutionProvider.asEffect(); + return (httpEffect) => + Effect.gen(function* () { + const request = yield* HttpServerRequest.HttpServerRequest; + const webRequest = yield* HttpServerRequest.toWeb(request); + const resolved = yield* options.strategy.renderFailure(options.authenticate(webRequest)); + // The strategy recovered the failure into a Response — return it. + if (!isPrincipal(resolved)) return resolved; + const auth = AuthContext.of(authContextFromPrincipal(resolved)); + return yield* httpEffect.pipe( + Effect.provideService(AuthContext, auth), + Effect.provideService(ExecutorService, executor), + Effect.provideService(ExecutionEngineService, engine), + provideExecutorExtensions(extensions as PluginExtensions), + ); + }).pipe(Effect.provideContext(captured as Context.Context)); + }), + ); +}; + +// `renderFailure` yields either the resolved `Principal` (proceed) or an +// already-built `HttpServerResponse` (the strategy recovered the failure). +const isPrincipal = ( + value: Principal | HttpServerResponse.HttpServerResponse, +): value is Principal => !HttpServerResponse.isHttpServerResponse(value); diff --git a/packages/core/api/src/server/host-foundation.ts b/packages/core/api/src/server/host-foundation.ts new file mode 100644 index 000000000..1b22b70c4 --- /dev/null +++ b/packages/core/api/src/server/host-foundation.ts @@ -0,0 +1,223 @@ +// --------------------------------------------------------------------------- +// Shared host-boot API foundation. +// +// Every product host (cloud, self-host, local) assembles the same protected +// API the same way: +// +// composePluginApi(plugins) +// -> observabilityMiddleware(api) (defect safety net) +// -> HttpApiBuilder.layer(api) (the routes) +// + CoreHandlers + composePluginHandlerLayer(plugins) +// + ErrorCapture (Sentry / console / in-memory) +// + RouterConfigLive (maxParamLength bump) +// +// They differ only in three knobs: +// - `errorCapture` — the host's `ErrorCapture` impl (Sentry vs console). +// - `router` — an optional prefixed `HttpRouter` view (self-host +// serves under `/api`; cloud/local serve at root). +// - the plugin set — typed straight off the passed tuple. +// +// The account API mounts the same provider-neutral `AccountHandlers` behind a +// per-request `AccountProvider`, again differing only by the optional router and +// the service-providing layer. +// +// `toApiHandler` is the `HttpRouter.toWebHandler(appLayer + platform)` boiler- +// plate that every web-handler binding repeats: build, expose `{ handler, +// dispose }`. The per-host listening adapters (TanStack Start request +// middleware, the Bun socket) stay app-specific. +// +// NOTE: this module intentionally imports nothing host-specific (no +// `cloudflare:workers`, no Bun platform), so it stays importable from the +// Workers test runtime and from every host. +// --------------------------------------------------------------------------- + +import { HttpApiBuilder } from "effect/unstable/httpapi"; +import { HttpRouter, HttpServer } from "effect/unstable/http"; +import { Layer } from "effect"; +import type { AnyPlugin } from "@executor-js/sdk"; + +import { observabilityMiddleware, type ErrorCapture } from "../observability"; +import { AccountHttpApi } from "../account/api"; +import { AccountHandlers } from "../account/handlers"; +import type { AccountProvider } from "../account/service"; +import { composePluginApi, composePluginHandlerLayer } from "../plugin-routes"; +import { CoreHandlers } from "../handlers"; +import { requestScopedMiddleware } from "./request-scoped"; +import { RouterConfigLive } from "./router-config"; + +// `HttpApiBuilder.layer` requires `HttpRouter.HttpRouter`; a host that serves +// the API under a path prefix passes a `router.prefixed("/api")` view as this +// layer so every route carries the prefix. Hosts serving at root omit it (the +// ambient default `HttpRouter` is used). The prefixed view DERIVES from the +// ambient router, so it both provides and requires `HttpRouter.HttpRouter` +// (self-host's `PrefixedRouterLive`). Keeping the requirement channel precise +// (not `any`) avoids leaking `any` into every assembled host layer. +type RouterLayer = Layer.Layer; + +// --------------------------------------------------------------------------- +// Protected (plugin) API +// --------------------------------------------------------------------------- + +export interface MakeProtectedApiLayerOptions { + /** + * The host's `ErrorCapture` implementation. Provided ABOVE the handler + + * middleware layers so both the `capture(...)` typed-channel translation + * (`StorageError -> InternalError(traceId)`) AND the observability + * middleware's defect catchall resolve the same backend. + */ + readonly errorCapture: Layer.Layer; + /** + * Optional prefixed `HttpRouter` view (e.g. `router.prefixed("/api")`). When + * present every API route serves under that prefix. Omit to serve at root. + */ + readonly router?: RouterLayer; +} + +/** + * Assemble the protected (plugin) API into its boot Layer. + * + * Wires, in order: `composePluginApi(plugins)` -> + * `observabilityMiddleware(api)` -> `HttpApiBuilder.layer(api)` provided with + * `CoreHandlers` + `composePluginHandlerLayer(plugins)` + the host's + * `ErrorCapture` + `RouterConfigLive` (+ the optional prefixed router). + * + * Returns `{ api, handlers, layer }` because hosts consume all three + * independently: + * - `api` — the composed `HttpApi` value, reused for Swagger/OpenAPI, + * `.prefix(...)` spec views, `HttpApiClient.ForApi`, and + * `.add(...)` of host-only groups (cloud docs). + * - `handlers` — `CoreHandlers` + every plugin's late-binding `handlers()` + * Layer; reused by test harnesses building against a fake + * middleware. + * - `layer` — the wired boot Layer. The plugin handler Layers stay + * late-binding (they require each plugin's `*ExtensionService` + * Tag), so the host provides its per-request execution-stack + * middleware on this `layer` itself. + */ +export const makeProtectedApiLayer = ( + plugins: TPlugins, + options: MakeProtectedApiLayerOptions, +) => { + const api = composePluginApi(plugins); + const handlers = Layer.mergeAll(CoreHandlers, composePluginHandlerLayer(plugins)); + + // `RouterConfigLive` is folded in here so every host gets the raised + // `maxParamLength` without re-wiring it; the optional prefixed router is + // merged alongside it so `HttpApiBuilder.layer`'s `HttpRouter` requirement is + // satisfied by the prefixed view when the host wants a path namespace. + const routerSupport = options.router + ? Layer.merge(RouterConfigLive, options.router) + : RouterConfigLive; + + const layer = HttpApiBuilder.layer(api).pipe( + Layer.provide(Layer.mergeAll(handlers, observabilityMiddleware(api))), + Layer.provide(options.errorCapture), + Layer.provide(routerSupport), + ); + + return { api, handlers, layer }; +}; + +// --------------------------------------------------------------------------- +// Account API +// --------------------------------------------------------------------------- + +export interface MakeAccountApiLayerOptions { + /** + * Optional prefixed `HttpRouter` view, matching the protected API's prefix so + * the account routes register on the same `/api`-prefixed router. + */ + readonly router?: RouterLayer; +} + +/** + * Mount the shared, provider-neutral `AccountHandlers` (me / API keys / org) + * behind a per-request `AccountProvider`: + * + * HttpApiBuilder.layer(AccountHttpApi) + * -> AccountHandlers + * -> the `AccountProvider`-providing middleware + * -> (optional) prefixed router + * + * `accountProviderMiddleware` is the router-middleware Layer that provides + * `AccountProvider` per request — `requestScopedMiddleware(accountProviderLayer) + * .layer` for the self-contained case (self-host's Better Auth service), or a + * bespoke middleware combined with `requestScopedMiddleware` (cloud builds the + * WorkOS service INSIDE the request body so it closes over the per-request + * postgres socket). Going through a router middleware means the handler's + * `AccountProvider` requirement is satisfied per-request WITHOUT leaking into the + * app layer's output requirements (a plain `Layer.provide` on the builder layer + * would leak it and break the host build). + * + * The middleware's three channels are generic (`MOut`/`ME`/`MR`) so the + * provided `Request.From<"Requires", AccountProvider>` marker AND each host's + * remaining requirements (cloud's long-lived control-plane + billing services, + * self-host's `never`) flow through precisely — a non-generic + * `Layer` parameter would widen the requirement channel to `any` + * and break the host build's leftover-requirement tracking. + * + * Use `accountProviderMiddlewareLayer(accountProviderLayer)` for the common case. + */ +export const makeAccountApiLayer = ( + accountProviderMiddleware: Layer.Layer, + options: MakeAccountApiLayerOptions = {}, +) => { + const base = HttpApiBuilder.layer(AccountHttpApi).pipe( + Layer.provide(AccountHandlers), + Layer.provide(accountProviderMiddleware), + ); + return options.router ? base.pipe(Layer.provide(options.router)) : base; +}; + +/** + * The common-case `AccountProvider` middleware: wrap a self-contained + * `Layer` in `requestScopedMiddleware` and take its `.layer`. + * (Hosts whose service must be built inside the request body — cloud — combine + * their own middleware with `requestScopedMiddleware` and pass that instead.) + */ +export const accountProviderMiddlewareLayer = ( + accountProviderLayer: Layer.Layer, +) => requestScopedMiddleware(accountProviderLayer).layer; + +// --------------------------------------------------------------------------- +// App-layer web-handler binding +// --------------------------------------------------------------------------- + +export interface ApiHandler { + readonly handler: (request: Request) => Promise; + readonly dispose: () => Promise; +} + +/** + * Bind a fully-assembled app `Layer` to a `fetch`-style web handler. + * + * This is the `HttpRouter.toWebHandler(appLayer + HttpServer.layerServices)` + * boilerplate every web-handler binding repeats: the web-handler binding + * supplies the HTTP platform services itself (no listening socket), then + * exposes `{ handler, dispose }`. Hosts that bind to a listening socket + * (self-host's Bun server) keep their own platform layer and DON'T use this. + * + * `appLayer` must already provide every `HttpRouter`/route requirement; this + * only adds `HttpServer.layerServices` so `toWebHandler` can run handlers off a + * synthetic platform. + */ +export const toApiHandler = ( + // The app layer must already provide every route requirement; only the HTTP + // platform is missing, which `HttpServer.layerServices` supplies below. Typed + // loosely (success/error/requirement channels erased) because each host's app + // layer has a different, fully-resolved set — self-host's `AppLayer` outputs + // `never`, local's outputs `ExecutorService | …` (provideMerge keeps them in + // the success channel). The runtime contract is the same either way. + // eslint-disable-next-line @typescript-eslint/no-explicit-any + appLayer: Layer.Layer, +): ApiHandler => { + // `HttpServer.layerServices` supplies the synthetic HTTP platform so + // `toWebHandler` can run handlers without a listening socket. + const web = HttpRouter.toWebHandler(appLayer.pipe(Layer.provideMerge(HttpServer.layerServices))); + // With every requirement provided the leftover `HR` is `never`, so `handler` + // is the one-arg `(request) => Promise` form — but the loose + // `R = any` input widens `HR` to `any` (a two-arg signature), so narrow back + // to the runtime contract. + const handler = web.handler as (request: Request) => Promise; + return { handler, dispose: web.dispose }; +}; diff --git a/packages/core/api/src/server/identity.ts b/packages/core/api/src/server/identity.ts new file mode 100644 index 000000000..15da8ac12 --- /dev/null +++ b/packages/core/api/src/server/identity.ts @@ -0,0 +1,130 @@ +// --------------------------------------------------------------------------- +// Provider-neutral identity seam — the ONE auth surface the executor API runs +// on. Cloud (WorkOS api-key + sealed-session) and self-host (Better Auth) each +// supply an `IdentityProvider` Layer; the shared `ExecutionStackMiddleware` +// (see `./execution-stack-middleware.ts`) consumes only this tag, never a +// provider's native session shape. Handlers depend only on `AuthContext`. +// +// Single source of truth promoted out of the two apps: +// - `Principal` — the neutral resolved identity (self-host's shape is +// the model: org name + roles; cloud passes `roles: []` +// and an empty email on the api-key path). +// - `AuthContext` — the one Context.Service handlers read (carries roles; +// cloud's old tag lacked them, forward-compatible). +// - `Unauthorized` / — the shared error set (httpApiStatus 401 / 403 / 503), +// `NoOrganization` / shared by every consumer in both apps. Self-host only +// `Unavailable` ever produces the first two; cloud also produces +// `Unavailable` (503) when api-key validation is down. +// - `IdentityProvider` — the swap seam: `authenticate(request) => +// Effect`. +// --------------------------------------------------------------------------- + +import { Context, Effect, Schema } from "effect"; + +/** + * The provider-neutral resolved identity. Both self-host's AuthProvider impls + * (single-admin, Better Auth) and cloud's WorkOS path produce this. Self-host's + * original `Principal` is the model — it carries `organizationName` (cloud's + * resolver already yielded it) AND `roles` (cloud supplies `[]`). + */ +export interface Principal { + readonly accountId: string; + readonly organizationId: string; + readonly organizationName: string; + readonly email: string; + readonly name: string | null; + readonly avatarUrl: string | null; + readonly roles: readonly string[]; +} + +/** + * The single `AuthContext` every executor-API handler reads. The roles-bearing + * tag from self-host is the model; cloud now provides `roles: []` on it, which + * is forward-compatible (cloud handlers never read roles today). + */ +export class AuthContext extends Context.Service< + AuthContext, + { + readonly accountId: string; + readonly organizationId: string; + readonly email: string; + readonly name: string | null; + readonly avatarUrl: string | null; + readonly roles: readonly string[]; + } +>()("@executor-js/api/AuthContext") {} + +/** Build the shared `AuthContext` value from a resolved `Principal`. */ +export const authContextFromPrincipal = (principal: Principal): AuthContext["Service"] => ({ + accountId: principal.accountId, + organizationId: principal.organizationId, + email: principal.email, + name: principal.name, + avatarUrl: principal.avatarUrl, + roles: principal.roles, +}); + +// Optional per-failure render hints. Self-host produces the bare error (these +// stay `undefined`) and its text strategy renders a generic body. Cloud fills +// `code` + `message` so its failure strategy can reproduce the exact +// `{ error, code }` JSON bytes its old `HttpResponseError` paths emitted. The +// status is fixed by the tag (401 / 403 / 503), so it is not carried as a field. +const renderHints = { + /** Machine-readable failure code (cloud's `{ code }` body field). */ + code: Schema.optional(Schema.String), + /** Human-readable message (cloud's `{ error }` body field). */ + message: Schema.optional(Schema.String), +} as const; + +/** Authenticated but not authorized — no valid credential. Renders 401. */ +export class Unauthorized extends Schema.TaggedErrorClass()( + "Unauthorized", + renderHints, + { httpApiStatus: 401 }, +) {} + +/** Valid credential, but the principal belongs to no organization. Renders 403. */ +export class NoOrganization extends Schema.TaggedErrorClass()( + "NoOrganization", + renderHints, + { httpApiStatus: 403 }, +) {} + +/** + * The credential could not be validated for a transient reason (cloud's api-key + * validation backend is down). Renders 503 — the caller should retry. Self-host + * never produces this; it is part of the shared set so cloud provides the SAME + * neutral `IdentityProvider` tag without a wider error channel. + */ +export class Unavailable extends Schema.TaggedErrorClass()( + "Unavailable", + renderHints, + { httpApiStatus: 503 }, +) {} + +/** + * The swap seam. Resolves an incoming request to a `Principal`. WorkOS (cloud) + * and Better Auth (self-host) are interchangeable implementations; nothing + * downstream knows which is wired. + * + * - succeeds with a `Principal` -> authenticated + * - fails `Unauthorized` -> no/invalid credential (renders 401) + * - fails `NoOrganization` -> valid credential, no org (renders 403) + * - fails `Unavailable` -> transient validation outage (renders 503; + * cloud only — self-host never produces it) + * + * Adapter-specific credential precedence (cloud's Bearer-api-key-beats-sealed- + * session, self-host's cookie/bearer/x-api-key cascade) stays INSIDE each impl. + * Adapter infra defects (cloud's WorkOS / user-store failures) are `Effect.die`d + * INSIDE the impl so they surface as 500 defects, never as this error channel. + */ +export type IdentityFailure = Unauthorized | NoOrganization | Unavailable; + +export interface IdentityProviderShape { + readonly authenticate: (request: Request) => Effect.Effect; +} + +export class IdentityProvider extends Context.Service()( + "@executor-js/api/IdentityProvider", +) {} diff --git a/apps/cloud/src/api/request-scoped.ts b/packages/core/api/src/server/request-scoped.ts similarity index 100% rename from apps/cloud/src/api/request-scoped.ts rename to packages/core/api/src/server/request-scoped.ts diff --git a/packages/core/api/src/server/router-config.ts b/packages/core/api/src/server/router-config.ts new file mode 100644 index 000000000..834eb92d9 --- /dev/null +++ b/packages/core/api/src/server/router-config.ts @@ -0,0 +1,11 @@ +import { HttpRouter } from "effect/unstable/http"; +import { Layer } from "effect"; + +// --------------------------------------------------------------------------- +// Shared `HttpRouter.RouterConfig`. Raises `maxParamLength` past the default +// so long path params (scope ids, execution ids, etc.) match instead of being +// truncated at the router's default limit. Every host serves the same routes, +// so they all use this single config. +// --------------------------------------------------------------------------- + +export const RouterConfigLive = Layer.succeed(HttpRouter.RouterConfig)({ maxParamLength: 1000 }); diff --git a/packages/core/api/src/server/scoped-executor.ts b/packages/core/api/src/server/scoped-executor.ts new file mode 100644 index 000000000..74e59d90e --- /dev/null +++ b/packages/core/api/src/server/scoped-executor.ts @@ -0,0 +1,135 @@ +// --------------------------------------------------------------------------- +// Shared scoped-executor factory + the host seams it reads from. +// +// Cloud and self-host historically hand-rolled an identical `createScopedExecutor`: +// read the DB handle from a host service, build fresh per-request plugins, build a +// hosted HTTP client, build the `[userOrgScope, orgScope]` scope stack (P1), and +// call `createExecutor({...})` with a byte-identical option shape. The ONLY real +// differences were the DB source/lifetime, the plugin instances, and two host +// config scalars (`allowLocalNetwork`, `webBaseUrl`). +// +// `makeScopedExecutor` owns that common body. The per-host knobs are injected +// through three Effect seams: +// - `DbProvider` (P2a, executor-fuma-db.ts) — the `{ db }` handle. Cloud's +// Layer rebuilds the postgres-js fuma client per request off the +// request-scoped `DbService`; self-host's Layer projects its long-lived +// handle. `makeScopedExecutor` just reads `db` — it never caches a handle, +// so both lifetimes are preserved by the Layer the host supplies. +// - `PluginsProvider` — the plugin array. Cloud injects per-request WorkOS +// credentials; self-host returns the plain plugin list. +// - `HostConfig` — `allowLocalNetwork` (drives the hosted HTTP client guard) +// and `webBaseUrl` (the core-tools elicitation base URL). +// +// This is host-composition machinery: it lives in `@executor-js/api/server` +// (the host surface), not in `@executor-js/sdk` (the plugin-author contract). +// `createExecutor`/`Executor` and the `makeUserOrgScopeStack` scope-id contract +// stay in the SDK and are imported from there. +// --------------------------------------------------------------------------- + +import { Context, Effect } from "effect"; + +import { + createExecutor, + makeUserOrgScopeStack, + type AnyPlugin, + type Executor, + type StorageFailure, +} from "@executor-js/sdk"; +import { makeHostedHttpClientLayer } from "@executor-js/sdk/host-internal"; + +import { DbProvider } from "./executor-fuma-db"; + +// --------------------------------------------------------------------------- +// HostConfig seam — the two host scalars that vary the `createExecutor` options. +// --------------------------------------------------------------------------- + +export interface HostConfigShape { + /** + * Whether the hosted HTTP client may dial private/loopback addresses. Each + * host reads it from config (`EXECUTOR_ALLOW_LOCAL_NETWORK` / `ALLOW_LOCAL_NETWORK`); + * production hosts leave it off. Drives `makeHostedHttpClientLayer`. + */ + readonly allowLocalNetwork: boolean; + /** + * Base URL of the executor's web UI. Threaded into `coreTools.webBaseUrl` so + * `secrets.create` can point the user at `${webBaseUrl}/secrets?...`. + */ + readonly webBaseUrl: string; +} + +export class HostConfig extends Context.Service()( + "@executor-js/sdk/HostConfig", +) {} + +// --------------------------------------------------------------------------- +// PluginsProvider seam — the per-host (and possibly per-request) plugin array. +// +// Returns an Effect so a host that needs request-scoped credentials (cloud reads +// WorkOS creds from the Worker env) can build fresh plugin instances each call, +// while a host with static plugins (self-host) just returns a constant array. +// --------------------------------------------------------------------------- + +export interface PluginsProviderShape { + readonly plugins: () => readonly AnyPlugin[]; +} + +export class PluginsProvider extends Context.Service()( + "@executor-js/sdk/PluginsProvider", +) {} + +// --------------------------------------------------------------------------- +// makeScopedExecutor — the shared per-(user, org) executor body. +// +// Scope stack is `[userOrgScope, orgScope]` (innermost first) from +// `makeUserOrgScopeStack` (P1): the user-within-org scope id bakes in the org id +// so the same user in a different org gets a distinct scope row; OAuth token +// writes target the inner scope, org-wide credentials the outer. +// +// The `createExecutor` option shape below is byte-identical to the bodies it +// replaces: `{ scopes, db, plugins, httpClientLayer, onElicitation: "accept-all", +// coreTools: { webBaseUrl } }`. +// +// `TPlugins` is a caller-supplied phantom: the `PluginsProvider` seam returns an +// erased `AnyPlugin[]` (a Context value can't carry the tuple type), so the host +// names its plugin tuple (`makeScopedExecutor(...)`) to recover +// the `Executor` shape with the plugin extension namespaces +// (`.openapi`, `.graphql`, …) that `providePluginExtensions` and callers read. +// The default keeps the un-narrowed `Executor` for hosts that don't care. +// --------------------------------------------------------------------------- + +export const makeScopedExecutor = < + const TPlugins extends readonly AnyPlugin[] = readonly AnyPlugin[], +>( + accountId: string, + organizationId: string, + organizationName: string, +): Effect.Effect, StorageFailure, DbProvider | PluginsProvider | HostConfig> => + Effect.gen(function* () { + const { db } = yield* DbProvider; + const { plugins: pluginsFactory } = yield* PluginsProvider; + const config = yield* HostConfig; + + const plugins = pluginsFactory(); + const httpClientLayer = makeHostedHttpClientLayer({ + allowLocalNetwork: config.allowLocalNetwork, + }); + + // The account id is the first segment of the persisted `user-org:` scope key + // (its namespace name is the contract; `makeUserOrgScopeStack` keeps it). + const scopes = makeUserOrgScopeStack(accountId, organizationId, organizationName); + + const executor = yield* createExecutor({ + scopes, + db, + plugins, + httpClientLayer, + onElicitation: "accept-all", + coreTools: { + webBaseUrl: config.webBaseUrl, + }, + }); + // The seam erases the plugin tuple type; the caller re-narrows via the + // `TPlugins` phantom. Runtime shape is identical to a typed + // `createExecutor({ plugins })` call. + return executor as Executor; + }); diff --git a/packages/core/execution/src/promise.ts b/packages/core/execution/src/promise.ts index 6333746b8..53dd65083 100644 --- a/packages/core/execution/src/promise.ts +++ b/packages/core/execution/src/promise.ts @@ -116,7 +116,8 @@ const wrapPromiseExecutor = (pe: PromiseExecutor): EffectExecutor => ({ list: () => fromPromise(() => pe.connections.list()), create: (input) => fromPromise(() => pe.connections.create(input)), updateTokens: (input) => fromPromise(() => pe.connections.updateTokens(input)), - setIdentityLabel: (id, label) => fromPromise(() => pe.connections.setIdentityLabel(id, label)), + setConnectionLabel: (id, label) => + fromPromise(() => pe.connections.setConnectionLabel(id, label)), accessToken: (id) => fromPromise(() => pe.connections.accessToken(id)), accessTokenAtScope: (id, scope) => fromPromise(() => pe.connections.accessTokenAtScope(id, scope)), diff --git a/packages/core/execution/src/tool-invoker.ts b/packages/core/execution/src/tool-invoker.ts index edf390682..3853a6c2d 100644 --- a/packages/core/execution/src/tool-invoker.ts +++ b/packages/core/execution/src/tool-invoker.ts @@ -3,8 +3,8 @@ import * as Cause from "effect/Cause"; import type { Executor, ToolId, - Tool, - ToolSchema, + ToolView, + ToolSchemaView, InvokeOptions, Source, } from "@executor-js/sdk/core"; @@ -297,7 +297,7 @@ const paginate = (all: readonly T[], offset: number, limit: number): PagedRes }; }; -type SearchableTool = Pick; +type SearchableTool = Pick; type PreparedField = { readonly raw: string; @@ -513,8 +513,8 @@ export const searchTools = Effect.fn("executor.tools.search")(function* ( ), ); const ranked = all - .filter((tool: Tool) => matchesNamespace(tool, options?.namespace)) - .map((tool: Tool) => scoreToolMatch(tool, query)) + .filter((tool: ToolView) => matchesNamespace(tool, options?.namespace)) + .map((tool: ToolView) => scoreToolMatch(tool, query)) .filter(Predicate.isNotNull) .sort((left, right) => right.score - left.score || left.path.localeCompare(right.path)); @@ -617,7 +617,7 @@ export const describeTool = Effect.fn("executor.tools.describe")(function* ( // Single tools.schema() call — it already fetches the tool row // internally. No need to also call tools.list() just for name/description. - const schema: ToolSchema | null = yield* executor.tools.schema(path); + const schema: ToolSchemaView | null = yield* executor.tools.schema(path); // tools.schema() returns null if the tool doesn't exist. Fall back to // a minimal stub so callers can still render something. diff --git a/packages/core/sdk/package.json b/packages/core/sdk/package.json index ef74a89d3..05f3f94c6 100644 --- a/packages/core/sdk/package.json +++ b/packages/core/sdk/package.json @@ -19,6 +19,7 @@ ".": "./src/index.ts", "./core": "./src/index.ts", "./shared": "./src/shared.ts", + "./host-internal": "./src/host-internal.ts", "./http-source": "./src/http-source.ts", "./promise": "./src/promise.ts", "./client": "./src/client.ts", @@ -45,6 +46,12 @@ "default": "./dist/shared.js" } }, + "./host-internal": { + "import": { + "types": "./dist/host-internal.d.ts", + "default": "./dist/host-internal.js" + } + }, "./http-source": { "import": { "types": "./dist/http-source.d.ts", @@ -82,10 +89,9 @@ "@effect/atom-react": "catalog:", "@effect/platform-node": "catalog:", "@effect/vitest": "catalog:", - "@types/better-sqlite3": "^7.6.13", + "@libsql/client": "catalog:", "@types/node": "catalog:", "@types/react": "catalog:", - "better-sqlite3": "^12.9.0", "drizzle-orm": "catalog:", "react": "catalog:", "tsup": "catalog:", diff --git a/packages/core/sdk/src/connections.test.ts b/packages/core/sdk/src/connections.test.ts index f77413a20..8c2ff1111 100644 --- a/packages/core/sdk/src/connections.test.ts +++ b/packages/core/sdk/src/connections.test.ts @@ -766,7 +766,7 @@ describe("connections", () => { }), ); - it.effect("setIdentityLabel updates the label", () => + it.effect("setConnectionLabel updates the label", () => Effect.gen(function* () { const { provider } = makeConnectionProvider({ key: "spotify" }); const executor = yield* createExecutor( @@ -793,13 +793,13 @@ describe("connections", () => { }), ); - yield* executor.connections.setIdentityLabel("conn-1", "alice@example"); + yield* executor.connections.setConnectionLabel("conn-1", "alice@example"); const got = yield* executor.connections.get("conn-1"); expect(got?.identityLabel).toBe("alice@example"); }), ); - it.effect("setIdentityLabel fails with ConnectionNotFoundError for unknown id", () => + it.effect("setConnectionLabel fails with ConnectionNotFoundError for unknown id", () => Effect.gen(function* () { const executor = yield* createExecutor( makeTestConfig({ @@ -808,7 +808,7 @@ describe("connections", () => { ); const err = yield* executor.connections - .setIdentityLabel("does-not-exist", "x") + .setConnectionLabel("does-not-exist", "x") .pipe(Effect.flip); expect(Predicate.isTagged(err, "ConnectionNotFoundError")).toBe(true); }), diff --git a/packages/core/sdk/src/executor-fuma-db.ts b/packages/core/sdk/src/executor-fuma-db.ts new file mode 100644 index 000000000..56ee1dce8 --- /dev/null +++ b/packages/core/sdk/src/executor-fuma-db.ts @@ -0,0 +1,93 @@ +// --------------------------------------------------------------------------- +// Shared FumaDB assembly (pure, driver-agnostic). +// +// Every host (self-host, local, sdk-test, cloud) historically hand-rolled the +// same driver-agnostic FumaDB wiring: build a fumadb factory from the latest +// schema, bind it to an already-opened drizzle handle through `drizzleAdapter`, +// and expose `{ db: fuma.orm(version), fuma }`. `createExecutorFumaDb` owns ONLY +// that assembly — the caller still opens its own driver (libSQL for SQLite, +// postgres-js for Postgres), applies its own PRAGMAs, and runs its own schema +// bring-up. The factory is dialect-generic via the `provider` param. +// +// This is a pure helper, not the `DbProvider` Effect seam. The seam +// (`DbProvider` / `dbProviderLayer`) is host-composition and lives in the host +// layer (`@executor-js/api/server`). This assembly stays in the SDK because the +// SDK's own sqlite test backend (`sqlite-test-db.ts`) builds its handle with it; +// hosts reach it (and the seam) through `@executor-js/api/server`, which +// re-exports `createExecutorFumaDb` from here. It is NOT on the plugin-author +// root barrel — host code imports it from `@executor-js/sdk/host-internal`. +// --------------------------------------------------------------------------- + +import { fumadb, type FumaDB } from "fumadb"; +import { type DrizzleRuntimeProvider } from "fumadb/adapters/drizzle"; +import { drizzleAdapter } from "fumadb/adapters/drizzle"; +import { schema as fumaSchema, type RelationsMap } from "fumadb/schema"; + +import type { FumaDb, FumaTables } from "./fuma-runtime"; + +// The FumaDB provider both the runtime-schema generator and the drizzle adapter +// understand. SQLite (libSQL) and PostgreSQL (postgres-js) are the only +// dialects in use today. +export type ExecutorDbProvider = DrizzleRuntimeProvider; + +export type ExecutorFumaSchema = ReturnType< + typeof fumaSchema> +>; + +export interface ExecutorFumaDb { + readonly db: FumaDb>; + readonly fuma: FumaDB[]>; +} + +export interface CreateExecutorFumaDbOptions { + readonly tables: TTables; + readonly namespace: string; + readonly version: string; + readonly provider: ExecutorDbProvider; +} + +/** + * Driver-agnostic FumaDB assembly. The caller passes an already-opened drizzle + * handle (it owns the driver, PRAGMAs, and schema bring-up); this wires the + * fumadb client over it and returns the `{ db, fuma }` query surface. + * + * NOTE: the drizzle `db` must already have its runtime schema attached (via + * `createDrizzleRuntimeSchemaFromTables`) for SQLite/Postgres relational + * queries to resolve — that schema generation stays caller-side because it is + * coupled to the caller's drizzle() construction. + */ +export const createExecutorFumaDb = ( + drizzleDb: unknown, + options: CreateExecutorFumaDbOptions, +): ExecutorFumaDb => { + const latestSchema = fumaSchema({ + version: options.version, + tables: options.tables, + }); + const factory = fumadb({ + namespace: options.namespace, + schemas: [latestSchema], + }); + const fuma = factory.client( + drizzleAdapter({ + db: drizzleDb, + provider: options.provider, + }), + ); + + return { + db: fuma.orm(options.version), + fuma, + }; +}; + +// The uniform handle each host exposes through the `DbProvider` Layer (defined +// in the host layer). The `db`/`fuma` come from `createExecutorFumaDb`; `close` +// releases the host's own driver. Hosts that keep extra connection objects (the +// raw sqlite handle, the postgres `sql`) layer those into their own concrete +// handle type and still satisfy this contract. +export interface ExecutorDbHandle< + TTables extends FumaTables = FumaTables, +> extends ExecutorFumaDb { + readonly close: () => Promise; +} diff --git a/packages/core/sdk/src/executor.ts b/packages/core/sdk/src/executor.ts index b7c8c7ad3..d758e55b1 100644 --- a/packages/core/sdk/src/executor.ts +++ b/packages/core/sdk/src/executor.ts @@ -127,12 +127,12 @@ import type { Scope } from "./scope"; import { RemoveSecretInput, SecretRef, SetSecretInput, type SecretProvider } from "./secrets"; import { Usage } from "./usages"; import { - ToolSchema, + ToolSchemaView, type RefreshSourceInput, type RemoveSourceInput, type Source, type SourceDetectionResult, - type Tool, + type ToolView, type ToolListFilter, } from "./types"; import { buildToolTypeScriptPreview, type ToolTypeScriptPreview } from "./schema-types"; @@ -192,11 +192,11 @@ export type Executor = { readonly scopes: readonly Scope[]; readonly tools: { - readonly list: (filter?: ToolListFilter) => Effect.Effect; + readonly list: (filter?: ToolListFilter) => Effect.Effect; /** Fetch a tool's schema view: JSON schemas with `$defs` * attached from the core `definition` table, plus TypeScript * preview strings. Returns `null` for unknown tool ids. */ - readonly schema: (toolId: string) => Effect.Effect; + readonly schema: (toolId: string) => Effect.Effect; /** Every `$defs` entry across every source, grouped by source id. * Used for bulk schema export and downstream TypeScript rendering. */ readonly definitions: () => Effect.Effect< @@ -308,7 +308,7 @@ export type Executor = { readonly updateTokens: ( input: UpdateConnectionTokensInput, ) => Effect.Effect; - readonly setIdentityLabel: ( + readonly setConnectionLabel: ( id: string, label: string | null, ) => Effect.Effect; @@ -543,7 +543,7 @@ const decodeJsonColumn = (value: unknown): unknown => { const decodeProviderState = Schema.decodeUnknownOption(ConnectionProviderState); -const rowToTool = (row: ToolRow, annotations?: ToolAnnotations): Tool => ({ +const rowToTool = (row: ToolRow, annotations?: ToolAnnotations): ToolView => ({ id: row.id, sourceId: row.source_id, pluginId: row.plugin_id, @@ -558,7 +558,7 @@ const staticDeclToTool = ( source: StaticSourceDecl, tool: StaticToolDecl, pluginId: string, -): Tool => ({ +): ToolView => ({ id: `${source.id}.${tool.name}`, sourceId: source.id, pluginId, @@ -1039,7 +1039,7 @@ const writeDefinitions = ( // so `tools.list({ query, sourceId })` matches across both. // --------------------------------------------------------------------------- -const toolMatchesFilter = (tool: Tool, filter: ToolListFilter): boolean => { +const toolMatchesFilter = (tool: ToolView, filter: ToolListFilter): boolean => { if (filter.sourceId && tool.sourceId !== filter.sourceId) return false; if (filter.query) { const q = filter.query.toLowerCase(); @@ -2025,7 +2025,7 @@ export const createExecutor = => @@ -3174,7 +3174,7 @@ export const createExecutor = Array.from(connectionProviders.keys()) as readonly string[]), create: (input) => connectionsCreate(input), updateTokens: (input) => connectionsUpdateTokens(input), - setIdentityLabel: (id, label) => connectionsSetIdentityLabel(id, label), + setConnectionLabel: (id, label) => connectionsSetConnectionLabel(id, label), accessToken: (id) => connectionsAccessToken(id), accessTokenAtScope: (id, scope) => connectionsAccessTokenAtScope(id, scope), remove: (input) => connectionsRemove(input), @@ -3408,7 +3408,7 @@ export const createExecutor = 0) { - const kept: Tool[] = []; + const kept: ToolView[] = []; for (const tool of filtered) { const match = resolveToolPolicy(tool.id, policies, scopeRank); if (match?.action === "block") { @@ -3471,7 +3471,7 @@ export const createExecutor = { readonly updateTokens: ( input: UpdateConnectionTokensInput, ) => Effect.Effect; - readonly setIdentityLabel: ( + readonly setConnectionLabel: ( id: string, label: string | null, ) => Effect.Effect; diff --git a/packages/core/sdk/src/promise.ts b/packages/core/sdk/src/promise.ts index 1615d4c44..3136fa6ac 100644 --- a/packages/core/sdk/src/promise.ts +++ b/packages/core/sdk/src/promise.ts @@ -24,12 +24,12 @@ export type { UpdateToolPolicyInput, } from "./policies"; export { - ToolSchema, + ToolSchemaView, SourceDetectionResult, type RefreshSourceInput, type RemoveSourceInput, type Source, - type Tool, + type ToolView, type ToolListFilter, } from "./types"; export type { ToolAnnotations } from "./core-schema"; diff --git a/packages/core/sdk/src/scope.test.ts b/packages/core/sdk/src/scope.test.ts new file mode 100644 index 000000000..f375bca61 --- /dev/null +++ b/packages/core/sdk/src/scope.test.ts @@ -0,0 +1,76 @@ +import { describe, expect, it } from "@effect/vitest"; + +import { makeUserOrgScopeStack, parseUserOrgScopeId, userOrgScopeId } from "./scope"; + +// The exact regex the workos-vault plugin used to inline. The parser must stay +// byte-for-byte equivalent to it, so we keep a private copy here purely to +// prove equivalence (the production parser references the SDK helper instead). +const LEGACY_REGEX = /^user-org:([^:]+):([^:]+)$/; + +const legacyParse = ( + id: string, +): { readonly userId: string; readonly organizationId: string } | null => { + const m = id.match(LEGACY_REGEX); + return m ? { userId: m[1]!, organizationId: m[2]! } : null; +}; + +describe("userOrgScopeId / parseUserOrgScopeId", () => { + it("produces the exact contract string", () => { + expect(userOrgScopeId("u1", "org42")).toBe("user-org:u1:org42"); + }); + + it.each([ + ["u1", "org42"], + // Tricky-but-colon-free ids: uuids, dashes, dots, unicode, encoded chars. + ["1a2b-c3d4", "00000000-0000-0000-0000-000000000000"], + ["user.with.dots", "org_underscore"], + ["usér", "örg"], + ["a b c", "o r g"], + ["user%3Aslash", "org+plus"], + ])("round-trips parse(build(%j, %j))", (userId, organizationId) => { + const parsed = parseUserOrgScopeId(userOrgScopeId(userId, organizationId)); + expect(parsed).toEqual({ userId, organizationId }); + }); + + // The legacy regex requires non-empty segments, so a built id with an empty + // segment does NOT round-trip. The empty-segment cases live in the + // equivalence block below (`user-org::b`, `user-org:a:`). + + // Equivalence proof: for representative + adversarial inputs the new parser + // must return exactly what the inlined workos-vault regex returned. + it.each([ + "user-org:u1:org42", + "user-org:a:b", + "user-org::b", // empty user segment -> no match (greedy [^:]+ needs >=1) + "user-org:a:", // empty org segment -> no match + "user-org:a:b:c", // extra colon -> no match (anchored, exactly two segments) + "user-org:a", // missing org segment -> no match + "user-org:", // nothing -> no match + "user-org:a:b ", // trailing space is part of the org segment -> matches + " user-org:a:b", // leading space breaks the anchor -> no match + "USER-ORG:a:b", // case-sensitive prefix -> no match + "org42", // bare org id -> no match + "user-org:a:b\nuser-org:c:d", // newline: $ would normally allow, but no `m` flag + "prefix-user-org:a:b", // prefix not anchored -> no match + "", + ])("matches the legacy regex for %j", (id) => { + expect(parseUserOrgScopeId(id)).toEqual(legacyParse(id)); + }); +}); + +describe("makeUserOrgScopeStack", () => { + it("builds [userOrgScope, orgScope] with byte-identical ids + naming", () => { + const [userOrgScope, orgScope] = makeUserOrgScopeStack("u1", "org42", "Acme"); + + expect(String(userOrgScope.id)).toBe("user-org:u1:org42"); + expect(userOrgScope.name).toBe("Personal · Acme"); + + expect(String(orgScope.id)).toBe("org42"); + expect(orgScope.name).toBe("Acme"); + }); + + it("orders innermost (user-org) first so per-user secrets isolate", () => { + const stack = makeUserOrgScopeStack("u1", "org42", "Acme"); + expect(stack.map((s) => String(s.id))).toEqual(["user-org:u1:org42", "org42"]); + }); +}); diff --git a/packages/core/sdk/src/scope.ts b/packages/core/sdk/src/scope.ts index 9fd34cacd..c9771b3d8 100644 --- a/packages/core/sdk/src/scope.ts +++ b/packages/core/sdk/src/scope.ts @@ -9,6 +9,79 @@ export const Scope = Schema.Struct({ }); export type Scope = typeof Scope.Type; +// --------------------------------------------------------------------------- +// User-org scope id — the per-user secret-isolation contract. +// +// A cloud/self-host executor's scope stack is `[userOrgScope, orgScope]` +// (innermost first). The inner scope id bakes the org into the user id so the +// same WorkOS user in a different org gets a distinct scope row, and per-user +// secrets/tokens written at this scope cannot leak to other members of the org. +// +// This id is produced by the host apps and *parsed* by the workos-vault plugin +// (to split it into per-field KEK context). Producer and parser MUST agree, so +// both reference the helpers below as the single source of truth. Do NOT change +// the string shape without updating every consumer in lockstep. +// --------------------------------------------------------------------------- + +const USER_ORG_SCOPE_PREFIX = "user-org:"; + +// Mirrors the historical workos-vault regex `^user-org:([^:]+):([^:]+)$`: +// the `user-org:` prefix followed by exactly two colon-free, non-empty +// segments. Kept anchored to a const so the producer and parser cannot drift. +const USER_ORG_SCOPE_ID_REGEX = /^user-org:([^:]+):([^:]+)$/; + +/** + * Build the per-user-within-org scope id. The single source of truth for the + * `user-org:${userId}:${organizationId}` string shape. + */ +export const userOrgScopeId = (userId: string, organizationId: string): string => + `${USER_ORG_SCOPE_PREFIX}${userId}:${organizationId}`; + +/** + * Inverse of {@link userOrgScopeId}. Returns the `{ userId, organizationId }` + * pair for a user-org scope id, or `null` for any other scope shape. + * + * Behaviour is identical to the legacy workos-vault regex + * `^user-org:([^:]+):([^:]+)$`: both segments are matched greedily as + * colon-free, non-empty runs, so an id with extra colons (e.g. + * `user-org:a:b:c`) or an empty segment does not match. userId/organizationId + * may be otherwise opaque. + */ +export const parseUserOrgScopeId = ( + id: string, +): { readonly userId: string; readonly organizationId: string } | null => { + const m = id.match(USER_ORG_SCOPE_ID_REGEX); + if (!m) return null; + return { userId: m[1]!, organizationId: m[2]! }; +}; + +/** + * Build the canonical `[userOrgScope, orgScope]` scope stack (innermost first) + * shared by the cloud and self-host per-request executors. The inner scope is + * named `Personal · ${organizationName}`; the outer scope is the bare org. + * + * Centralising this keeps the id shape and naming byte-identical across hosts + * and in lockstep with {@link parseUserOrgScopeId}. + */ +export const makeUserOrgScopeStack = ( + userId: string, + organizationId: string, + organizationName: string, +): readonly [Scope, Scope] => { + const createdAt = new Date(); + const userOrgScope = Scope.make({ + id: ScopeId.make(userOrgScopeId(userId, organizationId)), + name: `Personal · ${organizationName}`, + createdAt, + }); + const orgScope = Scope.make({ + id: ScopeId.make(organizationId), + name: organizationName, + createdAt, + }); + return [userOrgScope, orgScope]; +}; + /** * Source-add flows that do not expose a user-facing placement choice install * sources at the outermost visible scope. Local executors have one scope, while diff --git a/packages/core/sdk/src/sqlite-test-db.ts b/packages/core/sdk/src/sqlite-test-db.ts index 5b52ce607..ea95be445 100644 --- a/packages/core/sdk/src/sqlite-test-db.ts +++ b/packages/core/sdk/src/sqlite-test-db.ts @@ -1,15 +1,15 @@ -import Database from "better-sqlite3"; -import { drizzle, type BetterSQLite3Database } from "drizzle-orm/better-sqlite3"; +import { createClient, type Client } from "@libsql/client"; +import { drizzle, type LibSQLDatabase } from "drizzle-orm/libsql"; import { mkdirSync } from "node:fs"; -import { dirname } from "node:path"; -import { fumadb, type FumaDB } from "fumadb"; +import { dirname, resolve } from "node:path"; +import { type FumaDB } from "fumadb"; import { createDrizzleRuntimeSchemaFromTables, createDrizzleRuntimeSchemaSqlFromTables, - drizzleAdapter, } from "fumadb/adapters/drizzle"; -import { schema as fumaSchema, type RelationsMap } from "fumadb/schema"; +import { type schema as fumaSchema, type RelationsMap } from "fumadb/schema"; +import { createExecutorFumaDb } from "./executor-fuma-db"; import type { FumaDb, FumaTables } from "./fuma-runtime"; type SqliteTestFumaSchema = ReturnType< @@ -19,8 +19,8 @@ type SqliteTestFumaSchema = ReturnType< export interface SqliteTestFumaDb { readonly db: FumaDb>; readonly fuma: FumaDB[]>; - readonly drizzle: BetterSQLite3Database>; - readonly sqlite: Database.Database; + readonly drizzle: LibSQLDatabase>; + readonly client: Client; readonly close: () => Promise; } @@ -39,8 +39,13 @@ export const createSqliteTestFumaDb = async ( if (options.path && options.path !== ":memory:") { mkdirSync(dirname(options.path), { recursive: true }); } - const sqlite = new Database(options.path ?? ":memory:"); - sqlite.pragma("foreign_keys = ON"); + // libSQL `:memory:` is a single connection per client, matching the test's + // single-handle expectation. foreign_keys is per-connection (no shared + // handle to inherit it), so set it on this one. + const url = + !options.path || options.path === ":memory:" ? ":memory:" : `file:${resolve(options.path)}`; + const client = createClient({ url }); + await client.execute("PRAGMA foreign_keys = ON"); const schema = createDrizzleRuntimeSchemaFromTables({ tables: options.tables, @@ -48,7 +53,7 @@ export const createSqliteTestFumaDb = async ( version, provider: "sqlite", }); - const drizzleDb = drizzle(sqlite, { schema }); + const drizzleDb = drizzle({ client, schema }); for (const statement of createDrizzleRuntimeSchemaSqlFromTables({ tables: options.tables, @@ -56,31 +61,23 @@ export const createSqliteTestFumaDb = async ( version, provider: "sqlite", })) { - sqlite.exec(statement); + await client.execute(statement); } - const latestSchema = fumaSchema({ - version, + const { db, fuma } = createExecutorFumaDb(drizzleDb, { tables: options.tables, - }); - const factory = fumadb({ namespace, - schemas: [latestSchema], + version, + provider: "sqlite", }); - const fuma = factory.client( - drizzleAdapter({ - db: drizzleDb, - provider: "sqlite", - }), - ); return { - db: fuma.orm(version), + db, fuma, drizzle: drizzleDb, - sqlite, + client, close: async () => { - sqlite.close(); + client.close(); }, }; }; diff --git a/packages/core/sdk/src/types.ts b/packages/core/sdk/src/types.ts index 4fd67ad93..2d0bfbc21 100644 --- a/packages/core/sdk/src/types.ts +++ b/packages/core/sdk/src/types.ts @@ -47,12 +47,13 @@ export interface RefreshSourceInput { readonly targetScope: string; } -// `Tool` is the runtime view used across the SDK (with sourceId/pluginId/ -// annotations); `ToolSchema` below is the separate schema-side view that -// `executor.tools.schema(toolId)` returns. It can include TypeScript previews. -// These share a name root but are intentionally distinct shapes. +// `ToolView` is the runtime row-projection view used across the SDK (with +// sourceId/pluginId/annotations); `ToolSchemaView` below is the separate +// schema-side view that `executor.tools.schema(toolId)` returns. It can include +// TypeScript previews. These share a name root but are intentionally distinct +// shapes — and neither is the `tool()` builder or `ToolResult`. // oxlint-disable-next-line executor/prefer-schema-inferred-types -export interface Tool { +export interface ToolView { readonly id: string; readonly sourceId: string; /** Which plugin owns this tool. Matches the owning source's `pluginId`. */ @@ -65,13 +66,13 @@ export interface Tool { } // --------------------------------------------------------------------------- -// ToolSchema — the full schema-side view of a tool, returned by +// ToolSchemaView — the full schema-side view of a tool, returned by // `executor.tools.schema(toolId)`. Includes JSON schema roots plus shared // definitions for schema exploration, and optionally TypeScript preview strings // rendered from them via `schemaToTypeScriptPreview`. // --------------------------------------------------------------------------- -export const ToolSchema = Schema.Struct({ +export const ToolSchemaView = Schema.Struct({ id: ToolId, name: Schema.optional(Schema.String), description: Schema.optional(Schema.String), @@ -82,7 +83,7 @@ export const ToolSchema = Schema.Struct({ outputTypeScript: Schema.optional(Schema.String), typeScriptDefinitions: Schema.optional(Schema.Record(Schema.String, Schema.String)), }); -export type ToolSchema = typeof ToolSchema.Type; +export type ToolSchemaView = typeof ToolSchemaView.Type; // --------------------------------------------------------------------------- // Source detection — optional capability on `PluginSpec.detect`. When a diff --git a/packages/core/sdk/tsup.config.ts b/packages/core/sdk/tsup.config.ts index e6f9608d0..a5c077145 100644 --- a/packages/core/sdk/tsup.config.ts +++ b/packages/core/sdk/tsup.config.ts @@ -5,6 +5,7 @@ export default defineConfig({ index: "src/promise.ts", core: "src/index.ts", shared: "src/shared.ts", + "host-internal": "src/host-internal.ts", "http-source": "src/http-source.ts", client: "src/client.ts", testing: "src/testing.ts", diff --git a/packages/hosts/mcp/package.json b/packages/hosts/mcp/package.json index 296bfa87a..39c656d05 100644 --- a/packages/hosts/mcp/package.json +++ b/packages/hosts/mcp/package.json @@ -4,7 +4,14 @@ "private": true, "type": "module", "exports": { - ".": "./src/index.ts" + ".": { + "types": "./src/index.ts", + "default": "./src/index.ts" + }, + "./tool-server": { + "types": "./src/tool-server.ts", + "default": "./src/tool-server.ts" + } }, "scripts": { "typecheck": "tsgo --noEmit", diff --git a/packages/hosts/mcp/src/envelope.test.ts b/packages/hosts/mcp/src/envelope.test.ts new file mode 100644 index 000000000..ea4898416 --- /dev/null +++ b/packages/hosts/mcp/src/envelope.test.ts @@ -0,0 +1,135 @@ +// --------------------------------------------------------------------------- +// Envelope regression tests — lock in the streamable-HTTP contract the shared +// `McpServingRoutes` must preserve, independent of any provider: +// +// 1. A method the transport doesn't serve (PUT/PATCH/…) -> 405 -32001. +// 2. An OPTIONS preflight on a provider-declared discovery path -> 204 + CORS. +// 3. A request-orchestration defect -> 500 -32603 + the McpErrorReporter fires. +// +// Built with minimal stub seams so the assertions target the envelope alone. +// --------------------------------------------------------------------------- + +import { describe, expect, it } from "@effect/vitest"; +import { Cause, Effect, Layer, Ref } from "effect"; +import { HttpRouter, HttpServer } from "effect/unstable/http"; + +import { + authenticated, + McpAuthProvider, + McpErrorReporter, + McpErrorReporterNoop, + McpServingRoutes, + McpSessionStore, + type McpDispatchResult, + type Principal, +} from "./index"; + +const DISCOVERY_PATH = "/.well-known/oauth-protected-resource" as const; + +const TEST_PRINCIPAL: Principal = { + accountId: "acct_test", + organizationId: "org_test", + organizationName: "Test Org", + email: "test@example.com", + name: "Test", + avatarUrl: null, + roles: ["user"], +}; + +/** An auth provider that authenticates everything (so dispatch is reached). */ +const AuthProviderLive = Layer.succeed(McpAuthProvider)({ + discoveryRoutes: [ + { + path: DISCOVERY_PATH, + handler: () => Effect.succeed(new Response(JSON.stringify({ ok: true }), { status: 200 })), + }, + ], + resourceMetadataUrl: (request) => `${new URL(request.url).origin}${DISCOVERY_PATH}`, + authenticate: () => Effect.succeed(authenticated(TEST_PRINCIPAL)), +}); + +/** A store whose dispatch dies — induces the orchestration defect for case 3. */ +const DefectStoreLive = Layer.succeed(McpSessionStore)({ + dispatch: (): Effect.Effect => Effect.die("induced defect"), + dispose: () => Effect.void, +}); + +/** A store whose dispatch never runs — used for the 405 case (rejected first). */ +const OkStoreLive = Layer.succeed(McpSessionStore)({ + dispatch: (): Effect.Effect => + Effect.succeed(new Response(JSON.stringify({ jsonrpc: "2.0", id: 1 }), { status: 200 })), + dispose: () => Effect.void, +}); + +const buildHandler = ( + store: Layer.Layer, + reporter: Layer.Layer, +): ((request: Request) => Promise) => { + const Seams = Layer.mergeAll(AuthProviderLive, store, reporter); + const RouteLive = McpServingRoutes.pipe( + HttpRouter.provideRequest(Seams), + Layer.provide(AuthProviderLive), + ); + return HttpRouter.toWebHandler(RouteLive.pipe(Layer.provideMerge(HttpServer.layerServices))) + .handler; +}; + +describe("McpServingRoutes envelope", () => { + it("rejects a non-GET/POST/DELETE/OPTIONS method with 405 -32001 before dispatch", async () => { + const handler = buildHandler(OkStoreLive, McpErrorReporterNoop); + for (const method of ["PUT", "PATCH"] as const) { + const response = await handler( + new Request("https://host.test/mcp", { + method, + headers: { authorization: "Bearer x", "content-type": "application/json" }, + body: JSON.stringify({ jsonrpc: "2.0", id: 1, method: "tools/list" }), + }), + ); + expect(response.status, `${method} should be 405`).toBe(405); + const body = (await response.json()) as { error: { code: number; message: string } }; + expect(body.error.code).toBe(-32001); + expect(body.error.message).toMatch(/method not allowed/i); + } + }); + + it("answers an OPTIONS preflight on a discovery path with 204 + CORS", async () => { + const handler = buildHandler(OkStoreLive, McpErrorReporterNoop); + const response = await handler( + new Request(`https://host.test${DISCOVERY_PATH}`, { + method: "OPTIONS", + headers: { origin: "https://claude.ai", "access-control-request-method": "GET" }, + }), + ); + expect(response.status).toBe(204); + expect(response.headers.get("access-control-allow-origin")).toBe("*"); + expect(response.headers.get("access-control-allow-methods")).toBe("GET, POST, DELETE, OPTIONS"); + expect(response.headers.get("access-control-allow-headers") ?? "").toContain("authorization"); + }); + + it("renders 500 -32603 + CORS and fires the reporter on an orchestration defect", async () => { + const reported = await Effect.runPromise(Ref.make>([])); + const RecordingReporter = Layer.succeed(McpErrorReporter)({ + report: (cause: Cause.Cause) => + Ref.update(reported, (acc) => [...acc, Cause.pretty(cause)]), + }); + + const handler = buildHandler(DefectStoreLive, RecordingReporter); + const response = await handler( + new Request("https://host.test/mcp", { + method: "POST", + headers: { authorization: "Bearer x", "content-type": "application/json" }, + body: JSON.stringify({ jsonrpc: "2.0", id: 1, method: "tools/list" }), + }), + ); + + expect(response.status).toBe(500); + expect(response.headers.get("access-control-allow-origin")).toBe("*"); + const body = (await response.json()) as { error: { code: number; message: string } }; + expect(body.error.code).toBe(-32603); + expect(body.error.message).toMatch(/internal server error/i); + + const captures = await Effect.runPromise(Ref.get(reported)); + expect(captures).toHaveLength(1); + expect(captures[0]).toContain("induced defect"); + }); +}); diff --git a/packages/hosts/mcp/src/envelope.ts b/packages/hosts/mcp/src/envelope.ts new file mode 100644 index 000000000..bed9070ff --- /dev/null +++ b/packages/hosts/mcp/src/envelope.ts @@ -0,0 +1,278 @@ +import { Effect, Match, Predicate } from "effect"; +import { HttpRouter, HttpServerRequest, HttpServerResponse } from "effect/unstable/http"; + +import { + McpAuthProvider, + McpErrorReporter, + McpSessionStore, + type AuthOutcome, + type McpDispatchResult, +} from "./seams"; + +// --------------------------------------------------------------------------- +// Provider-neutral MCP serving envelope. +// +// Routes: +// GET -> McpAuthProvider metadata +// * /mcp -> authenticate -> dispatch +// +// The provider DECLARES the discovery paths it owns (at least the protected- +// resource metadata document) via `McpAuthProvider.discoveryRoutes`; the +// envelope never hard-codes `/.well-known/oauth-*`. The OAuth endpoints +// (/authorize, /token, /register) stay OUT of the envelope: they are served by +// the provider's own handler (self-host: Better Auth at /api/auth; cloud: +// WorkOS, external). The envelope only needs the provider's discovery routes, +// resource-metadata URL, and authenticate. +// +// The envelope hard-codes ONLY the `/mcp` path and CORS. Everything else — +// every `/.well-known/*` path, the resource-metadata URL, the authn/authz +// semantics, and the entire session lifecycle (create + forward + ownership) — +// comes from the two seams. +// +// Runtime-agnostic: built on `effect/unstable/http` (HttpRouter), NO +// platform-bun. The `/mcp` flow is fully Effect; the streamable-HTTP transport +// works on web `Request`/`Response`, so the envelope reconstructs the inbound +// web request once, hands it to the store, and wraps the store's `Response` +// with `HttpServerResponse.raw` (which passes a `Response` body through +// unchanged, preserving streaming SSE bodies). +// --------------------------------------------------------------------------- + +const MCP_PATH = "/mcp"; + +/** The methods the streamable-HTTP transport accepts on `/mcp`. */ +const ALLOWED_MCP_METHODS = new Set(["GET", "POST", "DELETE", "OPTIONS"]); + +/** + * The canonical CORS preflight `Response` (204) answered for an `OPTIONS` on + * `/mcp` AND on every provider-declared discovery path. A browser issues a + * preflight against the metadata docs too (RFC 9728 discovery from a 401), so + * the envelope answers OPTIONS for those paths, not only `/mcp`. + */ +const corsPreflightResponse = (): Response => + new Response(null, { + status: 204, + headers: { + "access-control-allow-origin": "*", + "access-control-allow-methods": "GET, POST, DELETE, OPTIONS", + "access-control-allow-headers": + "content-type, authorization, mcp-session-id, accept, mcp-protocol-version", + "access-control-expose-headers": "mcp-session-id, WWW-Authenticate", + }, + }); + +/** + * The canonical JSON-RPC error `Response` builder for every MCP serving site. + * + * Emits the EXACT body every host renders — `{jsonrpc:"2.0",error:{code,message}, + * id:null}` — with `content-type: application/json`. Two header policies: + * + * - `cors: true` (default) adds `access-control-allow-origin: *`. This is the + * envelope's policy and the cloud edge worker's (`jsonRpcWebResponse`): + * errors cross the browser boundary, so they carry CORS. A `challenge` + * additionally emits the `WWW-Authenticate` header + exposes it via CORS + * (the 401 path). + * - `cors: false` omits CORS entirely — for INNER responses that never reach + * the browser directly (the cloud Durable Object and the self-host /local + * in-process stores, whose `Response` is post-processed / re-wrapped with + * CORS by the outer envelope before it leaves the origin). + * + * One renderer, byte-identical bodies across host-mcp + cloud + self-host + + * local — the four hand-rolled copies are deleted in favor of this. + */ +export const jsonRpcErrorBody = ( + status: number, + code: number, + message: string, + opts?: { readonly cors?: boolean; readonly challenge?: string }, +): Response => { + const cors = opts?.cors ?? true; + const challenge = opts?.challenge; + return new Response(JSON.stringify({ jsonrpc: "2.0", error: { code, message }, id: null }), { + status, + headers: { + "content-type": "application/json", + ...(cors ? { "access-control-allow-origin": "*" } : {}), + ...(challenge + ? { + "www-authenticate": challenge, + "access-control-expose-headers": "WWW-Authenticate", + } + : {}), + }, + }); +}; + +/** The envelope's own CORS-on JSON-RPC error `Response`, optionally carrying a challenge. */ +const jsonRpcResponse = ( + status: number, + code: number, + message: string, + challenge?: string, +): Response => + challenge === undefined + ? jsonRpcErrorBody(status, code, message) + : jsonRpcErrorBody(status, code, message, { challenge }); + +/** + * Reconstruct a WHATWG `Request` from the Effect HTTP request. Prefer the + * underlying source `Request` (preserves the body stream the transport reads); + * otherwise rebuild from parts. A failed body read is a defect here, not a + * recoverable error. + */ +const toWebRequest = (req: HttpServerRequest.HttpServerRequest): Effect.Effect => + Effect.gen(function* () { + if (req.source instanceof Request) return req.source; + const headers = new Headers(req.headers as Record); + const hasBody = req.method !== "GET" && req.method !== "HEAD"; + // oxlint-disable-next-line executor/no-effect-escape-hatch -- boundary: rebuilding a web Request from a non-web source; a failed body read is an unrecoverable infra defect, not a domain error + const body = hasBody ? yield* req.text.pipe(Effect.orDie) : undefined; + return new Request(req.url, { method: req.method, headers, body }); + }); + +/** Serve a provider discovery document, wrapping its web `Response`. */ +const discoveryRoute = (handler: (request: Request) => Effect.Effect) => + Effect.gen(function* () { + const httpRequest = yield* HttpServerRequest.HttpServerRequest; + const request = yield* toWebRequest(httpRequest); + const response = yield* handler(request); + return HttpServerResponse.raw(response); + }); + +/** + * Render a non-`Authenticated` {@link AuthOutcome} to a web `Response`: + * Unauthorized -> 401 + RFC 9728 challenge (outcome's own, else a default + * built from the provider's `resourceMetadataUrl`) + * Forbidden -> 403 JSON-RPC (default code -32001) + * Unavailable -> 503 JSON-RPC -32001 + */ +const renderAuthError = ( + auth: McpAuthProvider["Service"], + request: Request, + outcome: Exclude, +): Response => + Match.value(outcome).pipe( + Match.tag("Unauthorized", (u) => + jsonRpcResponse( + 401, + -32001, + "Unauthorized", + u.challenge ?? `Bearer resource_metadata="${auth.resourceMetadataUrl(request)}"`, + ), + ), + Match.tag("Forbidden", (f) => jsonRpcResponse(403, f.code ?? -32001, f.message)), + Match.tag("Unavailable", (u) => jsonRpcResponse(503, -32001, u.message)), + Match.exhaustive, + ); + +/** Render a non-`Response` {@link McpDispatchResult} discriminant. */ +const renderDispatchError = (lookup: "not-found" | "forbidden"): Response => + lookup === "not-found" + ? jsonRpcResponse(404, -32001, "Session not found") + : jsonRpcResponse(403, -32003, "MCP session does not belong to the current bearer"); + +/** Dispatch a `/mcp` request through authenticate -> store.dispatch -> transport. */ +const mcpDispatch = Effect.gen(function* () { + const httpRequest = yield* HttpServerRequest.HttpServerRequest; + const auth = yield* McpAuthProvider; + const store = yield* McpSessionStore; + const request = yield* toWebRequest(httpRequest); + + // CORS preflight: answer before auth so unauthenticated clients can probe. + if (request.method === "OPTIONS") { + return HttpServerResponse.raw(corsPreflightResponse()); + } + + // Streamable-HTTP only defines GET/POST/DELETE on the endpoint. Any other + // method (PUT/PATCH/…) is rejected with a JSON-RPC 405 BEFORE auth/dispatch — + // otherwise it would fall through and spin up a session engine for a method + // the transport can't serve. + if (!ALLOWED_MCP_METHODS.has(request.method)) { + return HttpServerResponse.raw(jsonRpcResponse(405, -32001, "Method not allowed")); + } + + const sessionId = request.headers.get("mcp-session-id"); + + // Authenticate (and, for session-aware providers, authorize) on EVERY + // request. On a non-Authenticated outcome: + // - Forbidden -> dispose the live session first (cloud tears down a DO + // whose org access was revoked), then render the 403. The + // inbound request is forwarded so the store can propagate + // the request's W3C trace context onto the teardown RPC. + // - other -> render directly. + const outcome = yield* auth.authenticate(request); + if (!Predicate.isTagged(outcome, "Authenticated")) { + if (Predicate.isTagged(outcome, "Forbidden") && sessionId) { + yield* store.dispose(sessionId, request); + } + return HttpServerResponse.raw(renderAuthError(auth, request, outcome)); + } + const principal = outcome.principal; + + // No session id: per the streamable-HTTP transport contract, only POST opens + // a session. A GET needs an existing id (400); a DELETE on nothing is a + // no-op (204). Both short-circuit BEFORE dispatch so the store never spins up + // an engine for a bare GET/DELETE. + if (!sessionId) { + if (request.method === "GET") { + return HttpServerResponse.raw( + jsonRpcResponse(400, -32000, "mcp-session-id header required for SSE"), + ); + } + if (request.method === "DELETE") { + return HttpServerResponse.raw( + new Response(null, { status: 204, headers: { "access-control-allow-origin": "*" } }), + ); + } + } + + const result: McpDispatchResult = yield* store.dispatch({ + request, + principal, + sessionId, + method: request.method, + }); + return HttpServerResponse.raw(result instanceof Response ? result : renderDispatchError(result)); +}); + +/** + * The `/mcp` route. Wraps {@link mcpDispatch} in a top-level `catchCause`: a + * request-orchestration defect (a rejected cross-isolate RPC, a body-tee + * failure, …) is reported to the optional {@link McpErrorReporter} (Sentry / + * `ErrorCapture` parity — the provider's capture pipeline would never see it + * otherwise, since the envelope returns a `Response`) and rendered as a stable + * JSON-RPC 500 -32603 + CORS, rather than a bare platform 500 with no body. + */ +const mcpRoute = mcpDispatch.pipe( + Effect.catchCause((cause) => + Effect.gen(function* () { + const reporter = yield* McpErrorReporter; + yield* reporter.report(cause); + return HttpServerResponse.raw(jsonRpcResponse(500, -32603, "Internal server error")); + }), + ), +); + +/** + * The shared MCP serving routes, as an `HttpRouter.use` Layer. A host merges + * this with its other routes and provides the two seam Layers + the HTTP + * platform services. Provider-neutral: cloud adopts the same Layer next. + * + * The discovery `GET` routes come from `McpAuthProvider.discoveryRoutes`, so + * the provider — not the envelope — owns its `/.well-known/oauth-*` paths. An + * `OPTIONS` on each discovery path answers the same CORS preflight as `/mcp` + * (a browser preflights the metadata docs during RFC 9728 discovery). + */ +export const McpServingRoutes = HttpRouter.use((router) => + Effect.gen(function* () { + const auth = yield* McpAuthProvider; + for (const route of auth.discoveryRoutes) { + yield* router.add("GET", route.path, discoveryRoute(route.handler)); + yield* router.add( + "OPTIONS", + route.path, + Effect.sync(() => HttpServerResponse.raw(corsPreflightResponse())), + ); + } + yield* router.add("*", MCP_PATH, mcpRoute); + }), +); diff --git a/packages/hosts/mcp/src/index.ts b/packages/hosts/mcp/src/index.ts index 2ad4b1e83..08d0e7d74 100644 --- a/packages/hosts/mcp/src/index.ts +++ b/packages/hosts/mcp/src/index.ts @@ -1 +1,36 @@ -export { createExecutorMcpServer, type ExecutorMcpServerConfig } from "./server"; +// --------------------------------------------------------------------------- +// @executor-js/host-mcp — the provider-neutral MCP SERVING surface. +// +// This entry point exports ONLY the serving envelope (`McpServingRoutes`) + +// its seams (`McpAuthProvider` / `McpSessionStore` / `McpErrorReporter` / +// `Principal`) + the canonical JSON-RPC error renderer (`jsonRpcErrorBody`). +// +// The executor TOOL factory (`createExecutorMcpServer` — the execute/resume +// tools, the elicitation/browser-approval bridge, the Zod input schemas) is a +// different center of gravity: a host's session store builds an `McpServer` +// from it. It lives behind the `@executor-js/host-mcp/tool-server` subpath so +// the serving surface stays small and dependency-light. +// --------------------------------------------------------------------------- + +export { + Principal, + McpAuthProvider, + McpSessionStore, + McpErrorReporter, + McpErrorReporterNoop, + principalOwns, + authenticated, + unauthorized, + forbidden, + unavailable, + type AuthOutcome, + type McpAuthenticated, + type McpUnauthorized, + type McpForbidden, + type McpUnavailable, + type McpDiscoveryRoute, + type McpDispatchInput, + type McpDispatchResult, +} from "./seams"; + +export { McpServingRoutes, jsonRpcErrorBody } from "./envelope"; diff --git a/packages/hosts/mcp/src/seams.ts b/packages/hosts/mcp/src/seams.ts new file mode 100644 index 000000000..5c82295da --- /dev/null +++ b/packages/hosts/mcp/src/seams.ts @@ -0,0 +1,279 @@ +import { Context, Effect, Layer, Schema } from "effect"; +import type { Cause } from "effect"; + +// --------------------------------------------------------------------------- +// Provider-neutral MCP serving seams. +// +// The shared MCP serving envelope (see `./envelope`) depends ONLY on these TWO +// seams. Each product (self-host, cloud, local) provides its own Layer +// satisfying the same tags; the envelope never changes. The seams are kept +// deliberately small — anything provider-specific (Durable-Object trace +// propagation, response-peeking, browser-approval stores, elicitation modes, +// per-org engine construction) is configured *inside* a provider's adapter and +// never baked into the envelope. +// +// Two seams, deliberately: +// 1. McpAuthProvider — called on EVERY request. Authenticate AND authorize +// (it may read the `mcp-session-id` header to do session-aware org-authz). +// 2. McpSessionStore — owns the serving session lifecycle: create + forward + +// ownership, end to end, via a single `dispatch`. The store builds/forwards +// the transport and returns the transport `Response`. +// +// There is deliberately NO envelope-level engine seam. Self-host's in-process +// store builds its engine via an INTERNAL dependency (its Layer provides it); +// cloud's Durable-Object store builds its engine inside the DO. The engine is a +// store implementation detail, not an envelope seam. +// --------------------------------------------------------------------------- + +// --------------------------------------------------------------------------- +// Shared domain — the authenticated principal. +// +// One word per concept: this is the SAME authenticated-caller noun the +// executor-API runs on (`Principal` in `@executor-js/api/server`); the shapes +// are byte-identical so the Better Auth / WorkOS adapters map onto it without +// translation. host-mcp keeps its own Schema'd copy (it does not depend on +// `@executor-js/api`) so it remains the validated boundary between auth +// (provider) and serving (envelope). +// --------------------------------------------------------------------------- + +export const Principal = Schema.Struct({ + accountId: Schema.String, + organizationId: Schema.String, + organizationName: Schema.String, + email: Schema.String, + name: Schema.NullOr(Schema.String), + avatarUrl: Schema.NullOr(Schema.String), + roles: Schema.Array(Schema.String), +}); + +export type Principal = Schema.Schema.Type; + +/** Ownership is keyed on (accountId, organizationId) — a subset of the principal. */ +export const principalOwns = (owner: Principal, principal: Principal): boolean => + owner.accountId === principal.accountId && owner.organizationId === principal.organizationId; + +// --------------------------------------------------------------------------- +// AuthOutcome — the result of `McpAuthProvider.authenticate`. +// +// A typed, never-failing discriminated union (NOT `Principal | null`, NOT an +// error channel) so a provider can distinguish the cases the envelope renders +// differently: +// +// Authenticated -> proceed to session dispatch +// Unauthorized -> 401 + RFC 9728 `WWW-Authenticate` challenge +// Forbidden -> 403 JSON-RPC error (cloud: "No organization in session …", +// default code -32001) — a VALID bearer that lacks the +// authorization the resource requires (e.g. no org). Because +// `authenticate` runs on EVERY request, a provider can return +// Forbidden on a reused session too; the envelope then +// disposes that session before rendering the 403. +// Unavailable -> 503 JSON-RPC error (cloud: "Authentication temporarily +// unavailable …") — a transient verification failure the +// client should retry. +// +// Plain tagged objects (consumed in-process by the envelope's `Match`), with +// constructors so providers never hand-roll the shape. `Principal` is the +// only field that is itself Schema-validated; the union does not cross a +// serialization boundary, so it stays a TS union rather than a decoded Schema. +// --------------------------------------------------------------------------- + +export interface McpAuthenticated { + readonly _tag: "Authenticated"; + readonly principal: Principal; +} + +export interface McpUnauthorized { + readonly _tag: "Unauthorized"; + /** + * The full `WWW-Authenticate: Bearer …` challenge value to emit on the 401. + * When omitted the envelope synthesizes a default from + * {@link McpAuthProvider.resourceMetadataUrl}. A provider that needs a + * reason-sensitive challenge (cloud: `missing_bearer` -> no `error=` param, + * `invalid_token` -> `error="invalid_token", error_description=…`) supplies + * the exact string here. + */ + readonly challenge?: string; +} + +export interface McpForbidden { + readonly _tag: "Forbidden"; + /** JSON-RPC error code; defaults to -32001 (cloud's no-org code). */ + readonly code?: number; + readonly message: string; +} + +export interface McpUnavailable { + readonly _tag: "Unavailable"; + readonly message: string; +} + +export type AuthOutcome = McpAuthenticated | McpUnauthorized | McpForbidden | McpUnavailable; + +export const authenticated = (principal: Principal): McpAuthenticated => ({ + _tag: "Authenticated", + principal, +}); + +export const unauthorized = (challenge?: string): McpUnauthorized => + challenge === undefined ? { _tag: "Unauthorized" } : { _tag: "Unauthorized", challenge }; + +export const forbidden = (message: string, code?: number): McpForbidden => + code === undefined ? { _tag: "Forbidden", message } : { _tag: "Forbidden", code, message }; + +export const unavailable = (message: string): McpUnavailable => ({ + _tag: "Unavailable", + message, +}); + +// =========================================================================== +// SEAM 1 — McpAuthProvider: OAuth metadata + per-request authn/authz + challenge. +// +// The envelope serves the provider-DECLARED `/.well-known/oauth-*` docs from +// here and calls `authenticate` on EVERY `/mcp` request (create, forward, +// GET, DELETE). The OAuth endpoints themselves (/authorize, /token, /register) +// are NOT part of this seam — they are served by the provider's own handler +// (self-host: Better Auth at /api/auth; cloud: WorkOS, external), because the +// envelope only needs discovery routes + authenticate + resource URL. +// =========================================================================== + +/** + * One provider-served discovery document the envelope mounts as `GET path`. + * The provider OWNS its paths (self-host serves the bare origin-root docs; + * cloud serves `/.well-known/oauth-protected-resource/mcp`), so the envelope + * never hard-codes them. + */ +export interface McpDiscoveryRoute { + /** Absolute path the envelope mounts as `GET path` (an `HttpRouter` PathInput). */ + readonly path: `/${string}`; + readonly handler: (request: Request) => Effect.Effect; +} + +export class McpAuthProvider extends Context.Service< + McpAuthProvider, + { + /** + * The discovery routes this provider serves (at minimum the protected- + * resource metadata document). The envelope registers a `GET` for each. + */ + readonly discoveryRoutes: ReadonlyArray; + /** + * The absolute `resource_metadata` URL clients should follow from a 401, + * derived from the request (so it carries the live origin). Used by the + * envelope ONLY to build a default challenge when an `Unauthorized` outcome + * does not carry its own `challenge` string. Self-host = + * bare `…/.well-known/oauth-protected-resource`; cloud = + * `…/.well-known/oauth-protected-resource/mcp`. + */ + readonly resourceMetadataUrl: (request: Request) => string; + /** + * Resolve a request to a typed {@link AuthOutcome}. Never fails: provider + * errors collapse into `Unauthorized`/`Unavailable` outcomes. + * + * Called on EVERY request, so the provider may read the `mcp-session-id` + * header to do session-aware org-authorization (cloud re-checks live org + * membership on reused sessions and returns `Forbidden` when revoked; the + * envelope then disposes the session). Self-host pins one org and never + * returns Forbidden/Unavailable. + * + * MUST enforce token expiry itself — Better Auth's `getMcpSession` does NOT + * validate `accessTokenExpiresAt`, so an expired token must resolve to + * `Unauthorized` here. + */ + readonly authenticate: (request: Request) => Effect.Effect; + } +>()("@executor-js/host-mcp/McpAuthProvider") {} + +// =========================================================================== +// SEAM 2 — McpSessionStore: the ENTIRE MCP serving-session lifecycle. +// +// `dispatch` owns create + forward + ownership end to end: +// - sessionId null + POST initialize -> build/forward, returns the transport +// `Response` (incl. the minted `mcp-session-id` header). +// - sessionId present -> reuse/forward the existing session's transport. +// - cross-bearer -> `"forbidden"` (403 -32003). +// - unknown / timed out -> `"not-found"` (404 -32001). +// +// The store receives the full inbound `Request` (so a cross-isolate forward can +// stream the body and inject identity/trace headers) and the `method` (so it can +// distinguish GET peek-vs-stream from POST/DELETE). It owns transport creation, +// `server.connect`, `handleRequest`, the session id, ownership, and lifetime. +// +// There is no envelope-level engine seam: the store builds its engine itself +// (self-host: an INTERNAL dependency the store's Layer provides; cloud: inside +// the DO). +// =========================================================================== + +export interface McpDispatchInput { + readonly request: Request; + readonly principal: Principal; + readonly sessionId: string | null; + readonly method: string; +} + +/** + * The result of `dispatch`. A `Response` is returned verbatim (SSE-safe); + * `"not-found"` and `"forbidden"` are DISTINCT discriminants the envelope maps + * to 404 -32001 and 403 -32003 respectively. + */ +export type McpDispatchResult = Response | "not-found" | "forbidden"; + +export class McpSessionStore extends Context.Service< + McpSessionStore, + { + /** + * Serve one `/mcp` request end to end. Owns create (no session id + POST + * initialize), forward (session id present), and ownership (cross-bearer -> + * `"forbidden"`). Returns the transport `Response` to pass through, or a + * `"not-found"` / `"forbidden"` discriminant for the envelope to render. + */ + readonly dispatch: (input: McpDispatchInput) => Effect.Effect; + /** + * Tear down a session by id (idempotent). + * + * `request` carries the inbound `Request` SO a cross-isolate store (cloud's + * Durable Object) can forward it and propagate the request's W3C trace + * context (tracestate/baggage) onto the disposal RPC, stitching the teardown + * into the same trace. A single-node store (self-host / local) IGNORES it — + * the dispose runs in-process and carries no inbound trace context — which is + * why it is optional. The envelope passes it on the Forbidden-with-session + * teardown (the only call site that has a live request). + */ + readonly dispose: (sessionId: string, request?: Request) => Effect.Effect; + } +>()("@executor-js/host-mcp/McpSessionStore") {} + +// =========================================================================== +// SEAM 3 (optional) — McpErrorReporter: observe a request-orchestration defect. +// +// The envelope wraps the entire `/mcp` handling in a top-level `catchCause` and +// renders a JSON-RPC 500 -32603 (the streamable-HTTP transport never sees the +// raw defect; the client gets a stable error envelope + CORS). Because the +// envelope swallows the cause into a `Response`, a provider's existing error +// pipeline (cloud: Sentry `captureException`; self-host: `ErrorCapture`) would +// otherwise NEVER see it. This OPTIONAL seam restores that observability: the +// envelope yields `reporter.report(cause)` before rendering the 500. +// +// The default Layer ({@link McpErrorReporterNoop}) is a no-op, so host-mcp stays +// decoupled — a provider overrides it to forward the cause to its own capture. +// =========================================================================== + +export class McpErrorReporter extends Context.Service< + McpErrorReporter, + { + /** + * Report an orchestration defect the envelope is about to render as a + * JSON-RPC 500. Never fails (the 500 is rendered regardless); a provider + * forwards the cause to Sentry / its `ErrorCapture` here. + */ + readonly report: (cause: Cause.Cause) => Effect.Effect; + } +>()("@executor-js/host-mcp/McpErrorReporter") {} + +/** + * The no-op default. host-mcp ships this so the envelope can always resolve the + * seam; providers override it (cloud: Sentry capture + console; self-host: + * `ErrorCapture`) to regain orchestration-defect observability. + */ +export const McpErrorReporterNoop: Layer.Layer = Layer.succeed(McpErrorReporter)({ + report: () => Effect.void, +}); diff --git a/packages/hosts/mcp/src/server.test.ts b/packages/hosts/mcp/src/tool-server.test.ts similarity index 99% rename from packages/hosts/mcp/src/server.test.ts rename to packages/hosts/mcp/src/tool-server.test.ts index 34a5b669e..d41b1419b 100644 --- a/packages/hosts/mcp/src/server.test.ts +++ b/packages/hosts/mcp/src/tool-server.test.ts @@ -9,7 +9,7 @@ import type * as Cause from "effect/Cause"; import { FormElicitation, ToolId, UrlElicitation } from "@executor-js/sdk"; import type { ExecutionEngine, ExecutionResult } from "@executor-js/execution"; -import { createExecutorMcpServer, type ExecutorMcpServerConfig } from "./server"; +import { createExecutorMcpServer, type ExecutorMcpServerConfig } from "./tool-server"; // --------------------------------------------------------------------------- // Helpers diff --git a/packages/hosts/mcp/src/server.ts b/packages/hosts/mcp/src/tool-server.ts similarity index 100% rename from packages/hosts/mcp/src/server.ts rename to packages/hosts/mcp/src/tool-server.ts diff --git a/packages/plugins/encrypted-secrets/CHANGELOG.md b/packages/plugins/encrypted-secrets/CHANGELOG.md new file mode 100644 index 000000000..850a61fb1 --- /dev/null +++ b/packages/plugins/encrypted-secrets/CHANGELOG.md @@ -0,0 +1,6 @@ +# @executor-js/plugin-encrypted-secrets changelog + +This file exists for `changesets/action@v1` compatibility (it reads every +workspace package's `CHANGELOG.md` to build the Version Packages PR). +Canonical user-facing release notes are at `apps/cli/release-notes/next.md` +and on the GitHub Releases page. diff --git a/packages/plugins/encrypted-secrets/package.json b/packages/plugins/encrypted-secrets/package.json new file mode 100644 index 000000000..26898eaf1 --- /dev/null +++ b/packages/plugins/encrypted-secrets/package.json @@ -0,0 +1,26 @@ +{ + "name": "@executor-js/plugin-encrypted-secrets", + "version": "0.0.0", + "private": true, + "type": "module", + "exports": { + ".": "./src/index.ts" + }, + "scripts": { + "build": "tsup && (tsc --declaration --emitDeclarationOnly --outDir dist --rootDir src || true)", + "typecheck": "tsgo --noEmit", + "test": "bunx --bun vitest run", + "test:watch": "bunx --bun vitest" + }, + "dependencies": { + "@executor-js/sdk": "workspace:*", + "effect": "catalog:" + }, + "devDependencies": { + "@effect/vitest": "catalog:", + "@types/node": "catalog:", + "bun-types": "catalog:", + "tsup": "catalog:", + "vitest": "catalog:" + } +} diff --git a/packages/plugins/encrypted-secrets/src/index.test.ts b/packages/plugins/encrypted-secrets/src/index.test.ts new file mode 100644 index 0000000000000000000000000000000000000000..20fd2ac465dff4c603fd554cf5a75b2237f281eb GIT binary patch literal 6066 zcmcgwZI9bT5ax4##b6XKi`cxr8YHoo9B| zZ@Jt{#g(YnWY@d%^2{@{v(DF5Sv%U(+vQTHZc1;rxuXLu>vBzz_LI^1i@aTyX`9yh zm7bE`R(^xiw%_oB>^R%xJdKU*PPeNxwER&ttK9tLwo`hq(^|Vf>T;83y6#l|ptm}0 zTv^Zlwr4iGIZMl04+QNg!^U0ZWd9VyI^XDD^$sSP(UUOLnJl%UywjANmOQtMFVfN=?rS*m4u8Qt zT2MTp#cSHXAd(ezd22Ck^ez3Ss#lmNvaZg}YU+RQ$;0qVHV@P1bfb6uAT5gmJOe)c zT&A3wQ)6ySd28qZIj`f%d8aZh!Bz_fvN?D6Peo%ZZaUP*#(T3qe6jC$9zOeG@2%t? zug>@&N9R`71 zO13OKorqQ%qT<|C4Zin)4jmmWFTGkA{C#D_p+5upG!wL!Lf4sm!VoYqEf zbj=i#4-;HIVZCXJqJ4Y_hyt89?mbtOkHF}BoC;5dtVe4hU_m<|3~47J8lZt}b) zbu6Jn;ltX2Szg5(oX2({<`lk?yx#^)rt+EvddX2~$*Qko=Q zU7a}<;sI7ZGrNel9s{Kt^%u+DF*PK?-&cS?EjXT`CS^ zawj|6^s8~$Z~l+e^A2XZ(5R-*k#XXHM=(^EJ=zoQQal`%@Cg3~=Y7|*;mGq*4ad3E z5*&n)$9AS7e~>X*ggnQBvGk~akW(BDPq{5}<7QcIxrdn&CpXzq%9cX(#XSyndu zFjc7Bvl;nD^r~!3rfM`0>)hmPRrD>VbX{ESN9`2Wqy6N~ouR4Q!Zu;K_r=cXV(-sl zKb(?LYXmzC(8r!Q%;<0_43+aXbV&0STqrv*o7z0YPw7w59KQ;aubJ0^od|(d$49no ziuc^bpuF`v?5Mxy9!z8)JBE$7Wg}wffhM<|pD=>G@R5X@S!vLDNL8w2at=&t#?6NGu}L}|>^Np6Gkm}N{Ri7S89v8x-6rJNJ(WhjpPy`zk# zgZ7sh6-PDmafZ{c;%*%yH1{EdXW=4)UED)Q12&BAZel}Faio~#1RW=gWDYUc@g*=T%5vOQYi*oQgj5+*y7sF00K!501167Q z>u#HI#6duf1BzqlglQx8#$&&agj}(Z5ey^WoLX1#ETc59u66BD3sFS!Lau+Rakwt3 z)dN0$au$vKZ}|wq0M?E{Re?;4KphTVTh=~y>zQ6h(04N`sC|>@pNm~$FQ12;nacdfPMxV#g3VGaIL8VWv z?d~7`*&W)W0IiTk_ZH7yF8BWfvB$DPHG!~UPP1aKY(#f{d!g-+?20k7csIo<{c(u3 z=gOzRZD`3o=y_kbCI>3sy-o0m=-5v`0roii;Z*u literal 0 HcmV?d00001 diff --git a/packages/plugins/encrypted-secrets/src/index.ts b/packages/plugins/encrypted-secrets/src/index.ts new file mode 100644 index 000000000..0dc112690 --- /dev/null +++ b/packages/plugins/encrypted-secrets/src/index.ts @@ -0,0 +1,149 @@ +import { createCipheriv, createDecipheriv, randomBytes, scryptSync } from "node:crypto"; + +import { Effect } from "effect"; + +import { + definePlugin, + StorageError, + type PluginCtx, + type SecretProvider, +} from "@executor-js/sdk/core"; + +// --------------------------------------------------------------------------- +// Encrypted DB-backed secret provider for self-host. +// +// Secret values are stored AES-256-GCM-encrypted in the executor's +// plugin-storage table (scope-partitioned, scope-policy enforced) — never in +// plaintext, unlike the file-secrets provider. The master key comes from the +// host (EXECUTOR_SECRET_KEY or a persisted key file); a random per-value IV + +// auth tag are stored alongside the ciphertext. Only node:crypto is used. +// +// This is the multi-tenant-safe default writable provider for the self-hosted +// server, replacing the OS-keychain/plaintext-file providers that assume a +// single desktop user. +// --------------------------------------------------------------------------- + +type PluginStorage = PluginCtx["pluginStorage"]; + +const COLLECTION = "secrets"; +const KEY_SALT = "executor-encrypted-secrets/v1"; +const PAYLOAD_VERSION = "v1"; + +/** Derive a 32-byte AES key from an arbitrary-length master key string. */ +const deriveKey = (master: string): Buffer => scryptSync(master, KEY_SALT, 32); + +const encryptSecret = (key: Buffer, plaintext: string): Effect.Effect => + Effect.try({ + try: () => { + const iv = randomBytes(12); + const cipher = createCipheriv("aes-256-gcm", key, iv); + const ciphertext = Buffer.concat([cipher.update(plaintext, "utf8"), cipher.final()]); + const tag = cipher.getAuthTag(); + return [ + PAYLOAD_VERSION, + iv.toString("base64"), + tag.toString("base64"), + ciphertext.toString("base64"), + ].join("."); + }, + catch: (cause) => new StorageError({ message: "Failed to encrypt secret", cause }), + }); + +const decryptSecret = (key: Buffer, payload: string): Effect.Effect => + Effect.try({ + // A malformed payload, a wrong key, or tampered bytes all surface here: + // GCM verification fails in `decipher.final()`, and bad base64/arity throws + // before that — both land in the StorageError channel. + try: () => { + const parts = payload.split("."); + const iv = Buffer.from(parts[1] ?? "", "base64"); + const tag = Buffer.from(parts[2] ?? "", "base64"); + const ciphertext = Buffer.from(parts[3] ?? "", "base64"); + const decipher = createDecipheriv("aes-256-gcm", key, iv); + decipher.setAuthTag(tag); + return Buffer.concat([decipher.update(ciphertext), decipher.final()]).toString("utf8"); + }, + catch: (cause) => new StorageError({ message: "Failed to decrypt secret", cause }), + }); + +const makeEncryptedProvider = ( + key: Buffer, + storage: PluginStorage, + listScope: string, +): SecretProvider => ({ + key: "encrypted", + writable: true, + + get: (secretId, scope) => + storage + .getAtScope({ collection: COLLECTION, key: secretId, scope }) + .pipe( + Effect.flatMap((entry) => (entry ? decryptSecret(key, entry.data) : Effect.succeed(null))), + ), + + has: (secretId, scope) => + storage + .getAtScope({ collection: COLLECTION, key: secretId, scope }) + .pipe(Effect.map((entry) => entry !== null)), + + set: (secretId, value, scope) => + encryptSecret(key, value).pipe( + Effect.flatMap((payload) => + storage.put({ collection: COLLECTION, key: secretId, scope, data: payload }), + ), + Effect.asVoid, + ), + + delete: (secretId, scope) => + storage + .getAtScope({ collection: COLLECTION, key: secretId, scope }) + .pipe( + Effect.flatMap((entry) => + entry + ? storage.remove({ collection: COLLECTION, key: secretId, scope }).pipe(Effect.as(true)) + : Effect.succeed(false), + ), + ), + + // Scope-agnostic by interface; like file-secrets we surface the innermost + // scope for display. Per-call get/set/delete honor the explicit scope arg. + list: () => + storage + .list({ collection: COLLECTION }) + .pipe( + Effect.map((entries) => + entries + .filter((entry) => String(entry.scopeId) === listScope) + .map((entry) => ({ id: entry.key, name: entry.key })), + ), + ), +}); + +export interface EncryptedSecretsPluginConfig { + /** + * Master key (any non-empty string) — derived to 32 bytes via scrypt. The + * host is responsible for supplying a strong, persistent key + * (EXECUTOR_SECRET_KEY or a generated key file); a secret store with no key + * is unsafe, so this is required. + */ + readonly key: string; +} + +export const encryptedSecretsPlugin = definePlugin((options?: EncryptedSecretsPluginConfig) => { + const master = options?.key; + if (!master) { + // oxlint-disable-next-line executor/no-try-catch-or-throw, executor/no-error-constructor -- boundary: a secret store with no master key is unsafe; fail loud at construction + throw new Error("encryptedSecretsPlugin requires a non-empty `key`"); + } + const derivedKey = deriveKey(master); + return { + id: "encryptedSecrets" as const, + storage: () => ({}), + secretProviders: (ctx: PluginCtx) => [ + makeEncryptedProvider(derivedKey, ctx.pluginStorage, ctx.scopes[0]!.id), + ], + }; +}); + +// Exported for host-side tests / reuse. +export { deriveKey, encryptSecret, decryptSecret }; diff --git a/packages/plugins/encrypted-secrets/tsconfig.json b/packages/plugins/encrypted-secrets/tsconfig.json new file mode 100644 index 000000000..eebc1e6f1 --- /dev/null +++ b/packages/plugins/encrypted-secrets/tsconfig.json @@ -0,0 +1,24 @@ +{ + "compilerOptions": { + "target": "ES2022", + "module": "ESNext", + "moduleResolution": "Bundler", + "strict": true, + "skipLibCheck": true, + "lib": ["ES2022"], + "types": ["bun-types", "node"], + "noUnusedLocals": true, + "noImplicitOverride": true, + "plugins": [ + { + "name": "@effect/language-service", + "ignoreEffectSuggestionsInTscExitCode": true, + "ignoreEffectWarningsInTscExitCode": true, + "diagnosticSeverity": { + "preferSchemaOverJson": "off" + } + } + ] + }, + "include": ["src/**/*.ts"] +} diff --git a/packages/plugins/encrypted-secrets/tsup.config.ts b/packages/plugins/encrypted-secrets/tsup.config.ts new file mode 100644 index 000000000..5769be1ec --- /dev/null +++ b/packages/plugins/encrypted-secrets/tsup.config.ts @@ -0,0 +1,12 @@ +import { defineConfig } from "tsup"; + +export default defineConfig({ + entry: { + index: "src/index.ts", + }, + format: ["esm"], + dts: false, + sourcemap: true, + clean: true, + external: [/^@executor-js\//, /^effect/, /^@effect\//, "node:crypto"], +}); diff --git a/packages/plugins/encrypted-secrets/vitest.config.ts b/packages/plugins/encrypted-secrets/vitest.config.ts new file mode 100644 index 000000000..5bfa2d586 --- /dev/null +++ b/packages/plugins/encrypted-secrets/vitest.config.ts @@ -0,0 +1,8 @@ +import { defineConfig } from "vitest/config"; + +export default defineConfig({ + test: { + include: ["src/**/*.test.ts"], + passWithNoTests: true, + }, +}); diff --git a/packages/plugins/openapi/src/sdk/real-specs.test.ts b/packages/plugins/openapi/src/sdk/real-specs.test.ts index f96ae6116..a01f287b6 100644 --- a/packages/plugins/openapi/src/sdk/real-specs.test.ts +++ b/packages/plugins/openapi/src/sdk/real-specs.test.ts @@ -12,7 +12,7 @@ import { readFileSync } from "node:fs"; import { resolve } from "node:path"; import { createExecutor, Scope, ScopeId } from "@executor-js/sdk"; -import type { ToolSchema } from "@executor-js/sdk/core"; +import type { ToolSchemaView } from "@executor-js/sdk/core"; import { makeTestConfig, memorySecretsPlugin } from "@executor-js/sdk/testing"; import type { ParsedDocument } from "./parse"; @@ -75,7 +75,7 @@ const testScope = Scope.make({ name: "Real spec baseline", createdAt: new Date(0), }); -const schemaCache = new Map(); +const schemaCache = new Map(); const getRegisteredToolSchema = (namespace: string, specText: string, toolId: string) => Effect.gen(function* () { @@ -128,7 +128,7 @@ const extractionSummary = (result: ExtractionResult, selectedOperationIds: reado ), }); -const schemaPreviewSummary = (schema: ToolSchema) => { +const schemaPreviewSummary = (schema: ToolSchemaView) => { const schemaDefinitions = schema.schemaDefinitions ?? {}; const typeScriptDefinitions = schema.typeScriptDefinitions ?? {}; return { diff --git a/packages/plugins/workos-vault/src/sdk/secret-store.ts b/packages/plugins/workos-vault/src/sdk/secret-store.ts index 03a04ac07..826ac0bab 100644 --- a/packages/plugins/workos-vault/src/sdk/secret-store.ts +++ b/packages/plugins/workos-vault/src/sdk/secret-store.ts @@ -5,6 +5,7 @@ import { type FumaRow, type FumaTables, nullableTextColumn, + parseUserOrgScopeId, scopedExecutorTable, StorageError, type SecretProvider, @@ -159,12 +160,15 @@ const isKekNotReadyError = (error: WorkOSVaultClientError): boolean => export type WorkOSVaultContextForScope = (scopeId: string) => Record; export const defaultWorkOSVaultContextForScope: WorkOSVaultContextForScope = (scopeId) => { - const m = scopeId.match(/^user-org:([^:]+):([^:]+)$/); + // Parser is single-sourced in `@executor-js/sdk` alongside the producer + // (`userOrgScopeId` / `makeUserOrgScopeStack`), so the id shape the host apps + // emit and the shape we split here cannot drift. + const parsed = parseUserOrgScopeId(scopeId); const base: Record = { app: "executor", - organization_id: m ? m[2]! : scopeId, + organization_id: parsed ? parsed.organizationId : scopeId, }; - if (m) base.user_id = m[1]!; + if (parsed) base.user_id = parsed.userId; return base; }; diff --git a/packages/react/package.json b/packages/react/package.json index 4e07514ca..c208752de 100644 --- a/packages/react/package.json +++ b/packages/react/package.json @@ -8,6 +8,7 @@ "./api/*": "./src/api/*.tsx", "./plugins/*": "./src/plugins/*.tsx", "./pages/*": "./src/pages/*.tsx", + "./multiplayer/*": "./src/multiplayer/*.tsx", "./components/*": "./src/components/*.tsx", "./hooks/*": "./src/hooks/*.ts", "./lib/*": "./src/lib/*.ts", diff --git a/packages/react/src/api/account-atoms.tsx b/packages/react/src/api/account-atoms.tsx new file mode 100644 index 000000000..6077a87ba --- /dev/null +++ b/packages/react/src/api/account-atoms.tsx @@ -0,0 +1,46 @@ +import * as Atom from "effect/unstable/reactivity/Atom"; + +import { AccountApiClient } from "./account-client"; +import { ReactivityKey } from "./reactivity-keys"; + +// --------------------------------------------------------------------------- +// Account atoms — typed, cached, reactive queries/mutations over the shared +// `/account/*` surface. Used by the multiplayer shell, the API-keys page, and +// the org page. Provider-neutral: identical against cloud (WorkOS) and +// self-host (Better Auth). +// --------------------------------------------------------------------------- + +// ── Identity ───────────────────────────────────────────────────────────────── + +export const meAtom = AccountApiClient.query("account", "me", { + timeToLive: "5 minutes", + reactivityKeys: [ReactivityKey.auth], +}); + +// ── API keys ─────────────────────────────────────────────────────────────── + +export const apiKeysAtom = AccountApiClient.query("account", "listApiKeys", { + reactivityKeys: [ReactivityKey.apiKeys], +}); + +export const createApiKey = AccountApiClient.mutation("account", "createApiKey"); +export const revokeApiKey = AccountApiClient.mutation("account", "revokeApiKey"); + +// ── Organization members ───────────────────────────────────────────────────── + +export const orgMembersAtom = Atom.refreshOnWindowFocus( + AccountApiClient.query("account", "listMembers", { + timeToLive: "30 seconds", + reactivityKeys: [ReactivityKey.orgMembers], + }), +); + +export const orgRolesAtom = AccountApiClient.query("account", "listRoles", { + timeToLive: "5 minutes", + reactivityKeys: [ReactivityKey.orgMembers], +}); + +export const inviteMember = AccountApiClient.mutation("account", "inviteMember"); +export const removeMember = AccountApiClient.mutation("account", "removeMember"); +export const updateMemberRole = AccountApiClient.mutation("account", "updateMemberRole"); +export const updateOrgName = AccountApiClient.mutation("account", "updateOrgName"); diff --git a/packages/react/src/api/account-client.tsx b/packages/react/src/api/account-client.tsx new file mode 100644 index 000000000..20b88169e --- /dev/null +++ b/packages/react/src/api/account-client.tsx @@ -0,0 +1,33 @@ +import * as AtomHttpApi from "effect/unstable/reactivity/AtomHttpApi"; +import { FetchHttpClient, HttpClient, HttpClientRequest } from "effect/unstable/http"; +import { AccountHttpApi } from "@executor-js/api/client"; +import * as Effect from "effect/Effect"; + +import { reportApiClientInfrastructureCause } from "./client"; +import { getExecutorApiBaseUrl, getExecutorServerAuthorizationHeader } from "./server-connection"; + +// --------------------------------------------------------------------------- +// Shared account client — the provider-neutral `/account/*` surface. +// +// A separate AtomHttpApi service from `ExecutorApiClient` (which serves the +// core executor groups), mirroring the cloud split (a core client + an auth +// client). Both the cloud (WorkOS) and self-host (Better Auth) servers +// implement these paths, so this one client works for both — auth is the +// same-origin session cookie the browser sends automatically. +// --------------------------------------------------------------------------- + +const AccountApiClient = AtomHttpApi.Service<"AccountApiClient">()("AccountApiClient", { + api: AccountHttpApi, + httpClient: FetchHttpClient.layer, + transformClient: HttpClient.mapRequest((request) => { + let next = HttpClientRequest.prependUrl(request, getExecutorApiBaseUrl()); + const authorization = getExecutorServerAuthorizationHeader(); + if (authorization) { + next = HttpClientRequest.setHeader(next, "authorization", authorization); + } + return next; + }), + transformResponse: (effect) => Effect.tapCause(effect, reportApiClientInfrastructureCause), +}); + +export { AccountApiClient }; diff --git a/packages/react/src/api/client.tsx b/packages/react/src/api/client.tsx index 44c71c898..0a81de312 100644 --- a/packages/react/src/api/client.tsx +++ b/packages/react/src/api/client.tsx @@ -16,7 +16,7 @@ const isApiClientInfrastructureCause = (cause: Cause.Cause): boolean => onSome: (error) => Schema.isSchemaError(error) || HttpClientError.isHttpClientError(error), }); -const reportApiClientInfrastructureCause = (cause: Cause.Cause) => +export const reportApiClientInfrastructureCause = (cause: Cause.Cause) => Effect.sync(() => { if (!isApiClientInfrastructureCause(cause)) return; reportHandledFrontendError(cause, { diff --git a/packages/react/src/multiplayer/auth-context.tsx b/packages/react/src/multiplayer/auth-context.tsx new file mode 100644 index 000000000..34a083308 --- /dev/null +++ b/packages/react/src/multiplayer/auth-context.tsx @@ -0,0 +1,99 @@ +import React, { createContext, useContext, useEffect } from "react"; +import { useAtomValue } from "@effect/atom-react"; +import * as AsyncResult from "effect/unstable/reactivity/AsyncResult"; + +import { meAtom } from "../api/account-atoms"; + +// --------------------------------------------------------------------------- +// Shared auth seam for the multiplayer apps (cloud + self-host). +// +// `useAuth()` reflects the `/account/me` query: loading → unauthenticated → +// authenticated. Provider-neutral — the only difference between cloud (WorkOS) +// and self-host (Better Auth) is which server answers `me` and how the session +// cookie was minted. Analytics stay OUT of here; a host that wants to identify +// the user (cloud → PostHog) passes an `onIdentify` callback. +// --------------------------------------------------------------------------- + +export type AuthUser = { + id: string; + email: string; + name: string | null; + avatarUrl: string | null; +}; + +export type AuthOrganization = { + id: string; + name: string; +}; + +export type AuthState = + | { status: "loading" } + | { status: "unauthenticated" } + | { status: "authenticated"; user: AuthUser; organization: AuthOrganization | null }; + +export type IdentifyFn = ( + state: Extract | { status: "unauthenticated" }, +) => void; + +const AuthContext = createContext({ status: "loading" }); + +export const useAuth = () => useContext(AuthContext); + +const AuthProviderClient = ({ + children, + onIdentify, +}: { + children: React.ReactNode; + onIdentify?: IdentifyFn; +}) => { + const result = useAtomValue(meAtom); + + const state: AuthState = AsyncResult.match(result, { + onInitial: () => ({ status: "loading" as const }), + onSuccess: ({ value }) => ({ + status: "authenticated" as const, + user: value.user, + organization: value.organization, + }), + onFailure: () => ({ status: "unauthenticated" as const }), + }); + + // Primitive identity fields so the identify effect fires only on real + // transitions (the `state` object is rebuilt every render). + const status = state.status; + const userId = state.status === "authenticated" ? state.user.id : null; + const email = state.status === "authenticated" ? state.user.email : null; + const name = state.status === "authenticated" ? state.user.name : null; + const avatarUrl = state.status === "authenticated" ? state.user.avatarUrl : null; + const organizationId = state.status === "authenticated" ? (state.organization?.id ?? null) : null; + const organizationName = + state.status === "authenticated" ? (state.organization?.name ?? null) : null; + + useEffect(() => { + if (!onIdentify) return; + if (status === "authenticated" && userId && email !== null) { + onIdentify({ + status: "authenticated", + user: { id: userId, email, name, avatarUrl }, + organization: organizationId ? { id: organizationId, name: organizationName ?? "" } : null, + }); + } else if (status === "unauthenticated") { + onIdentify({ status: "unauthenticated" }); + } + }, [onIdentify, status, userId, email, name, avatarUrl, organizationId, organizationName]); + + return {children}; +}; + +export const AuthProvider = ({ + children, + onIdentify, +}: { + children: React.ReactNode; + onIdentify?: IdentifyFn; +}) => { + if (typeof window === "undefined") { + return {children}; + } + return {children}; +}; diff --git a/packages/react/src/multiplayer/shell.tsx b/packages/react/src/multiplayer/shell.tsx new file mode 100644 index 000000000..71304e8f2 --- /dev/null +++ b/packages/react/src/multiplayer/shell.tsx @@ -0,0 +1,391 @@ +import { Link, Outlet, useLocation } from "@tanstack/react-router"; +import { useEffect, useRef, useState, type ReactNode } from "react"; +import { useAtomValue } from "@effect/atom-react"; +import * as AsyncResult from "effect/unstable/reactivity/AsyncResult"; +import { sourcesOptimisticAtom } from "../api/atoms"; +import { useScope } from "../api/scope-context"; +import { Button } from "../components/button"; +import { Skeleton } from "../components/skeleton"; +import { + DropdownMenu, + DropdownMenuContent, + DropdownMenuItem, + DropdownMenuLabel, + DropdownMenuSeparator, + DropdownMenuTrigger, +} from "../components/dropdown-menu"; +import { SourceFavicon, sourcePresetIconUrl } from "../components/source-favicon"; +import { CommandPalette } from "../components/command-palette"; +import { useSourcePlugins } from "@executor-js/sdk/client"; +import { useAuth } from "./auth-context"; + +// --------------------------------------------------------------------------- +// Shared multiplayer shell (cloud + self-host). +// +// Provider-neutral: identity comes from the shared `useAuth()` seam. The bits +// that genuinely differ per product are injected: +// - `onSignOut` how the session is ended (WorkOS logout vs Better Auth) +// - `orgMenuSlot` org switcher / create-org (cloud only) +// - `supportSlot` support dialog button (cloud only) +// - `navItems` which sections show (e.g. cloud adds Billing) +// Everything visual is identical so both products look the same. +// --------------------------------------------------------------------------- + +export type ShellNavItem = { readonly to: string; readonly label: string }; + +/** Sources lives at "/", plus the standard tool-management sections. Hosts + * spread this and append their own (e.g. Organization, Billing). */ +export const defaultShellNavItems: ReadonlyArray = [ + { to: "/", label: "Sources" }, + { to: "/connections", label: "Connections" }, + { to: "/secrets", label: "Secrets" }, + { to: "/policies", label: "Policies" }, +]; + +export interface ShellProps { + /** End the session. Cloud POSTs its logout path; self-host calls Better Auth. */ + readonly onSignOut: () => void | Promise; + /** Nav sections; defaults to {@link defaultShellNavItems}. */ + readonly navItems?: ReadonlyArray; + /** Where the "API keys" footer link goes; null hides it. Default "/api-keys". */ + readonly apiKeysTo?: string | null; + /** Injected into the account dropdown — cloud's org switcher / create-org. */ + readonly orgMenuSlot?: ReactNode; + /** Injected support button above the account footer (cloud). */ + readonly supportSlot?: ReactNode; +} + +// ── Brand ──────────────────────────────────────────────────────────────── + +function Brand(props: { onNavigate?: () => void }) { + return ( + + executor + + Beta + + + ); +} + +// ── NavItem ────────────────────────────────────────────────────────────── + +function NavItem(props: { to: string; label: string; active: boolean; onNavigate?: () => void }) { + return ( + + {props.label} + + ); +} + +// ── SourceList ─────────────────────────────────────────────────────────── + +function SourceList(props: { pathname: string; onNavigate?: () => void }) { + const scopeId = useScope(); + const sources = useAtomValue(sourcesOptimisticAtom(scopeId)); + const sourcePlugins = useSourcePlugins(); + + return AsyncResult.match(sources, { + onInitial: () => ( +
+ {[80, 65, 72, 58, 68].map((w, i) => ( +
+ + +
+ ))} +
+ ), + onFailure: () => ( +
No sources yet
+ ), + onSuccess: ({ value }) => + value.length === 0 ? ( +
+ No sources yet +
+ ) : ( +
+ {value.map((s) => { + const detailPath = `/sources/${s.id}`; + const active = + props.pathname === detailPath || props.pathname.startsWith(`${detailPath}/`); + return ( + + + {s.name} + + {s.kind} + + + ); + })} +
+ ), + }); +} + +// ── Avatar / initials ────────────────────────────────────────────────────── + +function initialsFor(name: string | null, email: string) { + if (name) { + return name + .split(" ") + .map((n) => n[0]) + .join("") + .slice(0, 2) + .toUpperCase(); + } + return email[0]!.toUpperCase(); +} + +function Avatar(props: { url: string | null; name: string | null; email: string }) { + if (props.url) { + return ; + } + return ( +
+ {initialsFor(props.name, props.email)} +
+ ); +} + +// ── UserFooter ────────────────────────────────────────────────────────── + +function UserFooter(props: Pick) { + const auth = useAuth(); + if (auth.status !== "authenticated") return null; + const apiKeysTo = props.apiKeysTo === undefined ? "/api-keys" : props.apiKeysTo; + + return ( +
+ + + + + + {props.orgMenuSlot} + {apiKeysTo && ( + <> + + API keys + + + + )} + + Signed in as + + + +
+

+ {auth.user.name ?? auth.user.email} +

+ {auth.user.name && ( +

{auth.user.email}

+ )} +
+ + void props.onSignOut()} + > + Sign out + + + +
+ ); +} + +// ── SidebarContent ─────────────────────────────────────────────────────── + +function SidebarContent( + props: ShellProps & { pathname: string; onNavigate?: () => void; showBrand?: boolean }, +) { + const navItems = props.navItems ?? defaultShellNavItems; + return ( + <> + {props.showBrand !== false && ( +
+ +
+ )} + + + + {props.supportSlot &&
{props.supportSlot}
} + + + + ); +} + +// ── Shell ───────────────────────────────────────────────────────────────── + +export function Shell(props: ShellProps) { + const location = useLocation(); + const pathname = location.pathname; + const lastPathname = useRef(pathname); + const [mobileSidebarOpen, setMobileSidebarOpen] = useState(false); + if (lastPathname.current !== pathname) { + lastPathname.current = pathname; + if (mobileSidebarOpen) setMobileSidebarOpen(false); + } + + useEffect(() => { + if (!mobileSidebarOpen) return; + const prev = document.body.style.overflow; + document.body.style.overflow = "hidden"; + return () => { + document.body.style.overflow = prev; + }; + }, [mobileSidebarOpen]); + + return ( +
+ + {/* Desktop sidebar */} + + + {/* Mobile sidebar overlay */} + {mobileSidebarOpen && ( +
+ {/* oxlint-disable-next-line react/forbid-elements */} + +
+ setMobileSidebarOpen(false)} + showBrand={false} + /> +
+ + )} + + {/* Main content */} +
+ {/* Mobile top bar */} +
+ + +
+
+ + +
+ + ); +} diff --git a/packages/react/src/pages/api-keys.tsx b/packages/react/src/pages/api-keys.tsx new file mode 100644 index 000000000..15e7e8768 --- /dev/null +++ b/packages/react/src/pages/api-keys.tsx @@ -0,0 +1,266 @@ +import { useState } from "react"; +import { Exit } from "effect"; +import * as AsyncResult from "effect/unstable/reactivity/AsyncResult"; +import { useAtomSet, useAtomValue } from "@effect/atom-react"; +import { toast } from "sonner"; +import { apiKeyWriteKeys } from "../api/reactivity-keys"; +import { apiKeysAtom, createApiKey, revokeApiKey } from "../api/account-atoms"; +import { Button } from "../components/button"; +import { CopyButton } from "../components/copy-button"; +import { + Dialog, + DialogClose, + DialogContent, + DialogDescription, + DialogFooter, + DialogHeader, + DialogTitle, +} from "../components/dialog"; +import { Input } from "../components/input"; +import { Label } from "../components/label"; + +// --------------------------------------------------------------------------- +// Shared API-keys page. Reads/writes the provider-neutral `/account/api-keys` +// surface, so it works identically on cloud (WorkOS) and self-host (Better +// Auth). API keys are how a user authenticates the Executor API + MCP endpoint +// from scripts/agents (Authorization: Bearer ). +// --------------------------------------------------------------------------- + +type ApiKeySummary = { + readonly id: string; + readonly name: string; + readonly obfuscatedValue: string; + readonly createdAt: string; + readonly lastUsedAt: string | null; +}; + +type CreatedKey = ApiKeySummary & { readonly value: string }; + +const formatDate = (value: string | null): string => { + if (!value) return "Never"; + const date = new Date(value); + return Number.isNaN(date.getTime()) + ? value + : new Intl.DateTimeFormat(undefined, { + month: "short", + day: "numeric", + year: "numeric", + }).format(date); +}; + +const defaultApiKeyName = (): string => + `API key ${new Intl.DateTimeFormat(undefined, { + month: "short", + day: "numeric", + year: "numeric", + }).format(new Date())}`; + +export function ApiKeysPage() { + const result = useAtomValue(apiKeysAtom); + const doCreate = useAtomSet(createApiKey, { mode: "promiseExit" }); + const doRevoke = useAtomSet(revokeApiKey, { mode: "promiseExit" }); + const [createOpen, setCreateOpen] = useState(false); + const [name, setName] = useState(""); + const [createdKey, setCreatedKey] = useState(null); + const [creating, setCreating] = useState(false); + const [revokingId, setRevokingId] = useState(null); + + const handleCreate = async () => { + const trimmed = name.trim(); + if (!trimmed) return; + setCreating(true); + const exit = await doCreate({ payload: { name: trimmed }, reactivityKeys: apiKeyWriteKeys }); + setCreating(false); + if (Exit.isSuccess(exit)) { + setCreatedKey(exit.value); + setName(""); + toast.success("API key created"); + return; + } + toast.error("Failed to create API key"); + }; + + const handleRevoke = async (key: ApiKeySummary) => { + setRevokingId(key.id); + const exit = await doRevoke({ params: { apiKeyId: key.id }, reactivityKeys: apiKeyWriteKeys }); + setRevokingId(null); + if (Exit.isSuccess(exit)) { + toast.success(`Revoked ${key.name}`); + return; + } + toast.error("Failed to revoke API key"); + }; + + const closeCreate = (open: boolean) => { + setCreateOpen(open); + if (!open) { + setName(""); + setCreatedKey(null); + setCreating(false); + } + }; + + return ( +
+
+
+
+

API keys

+

+ User keys for accessing the Executor API and MCP endpoint from scripts and tools. +

+
+ + Authorization: Bearer <api-key> + + +
+

+ API keys work as PATs and have full access to your account. +

+
+ +
+ + {AsyncResult.match(result, { + onInitial: () => ( +
+ Loading API keys... +
+ ), + onFailure: () => ( +
+ Failed to load API keys +
+ ), + onSuccess: ({ value }) => + value.apiKeys.length === 0 ? ( +
+

No API keys

+

+ Create a key and send it in the Authorization Bearer header. +

+
+ ) : ( +
+
+ Name + Created + Last used + Actions +
+ {value.apiKeys.map((key: ApiKeySummary) => ( +
+
+

{key.name}

+

+ {key.obfuscatedValue} +

+
+

+ {formatDate(key.createdAt)} +

+

+ {formatDate(key.lastUsedAt)} +

+ +
+ ))} +
+ ), + })} +
+ + + + + Create API key + + The key will act as your user in the current organization. + + + + {createdKey ? ( +
+
+ +
+ + +
+
+
+ +
+ + +
+
+

+ Send this value as a Bearer token. It is only shown once. +

+
+ ) : ( +
+
+ + setName(event.target.value)} + placeholder="Local CLI" + maxLength={80} + autoFocus + /> +
+
+ )} + + + + + + {!createdKey && ( + + )} + + + +
+ ); +} diff --git a/packages/react/src/pages/org.tsx b/packages/react/src/pages/org.tsx new file mode 100644 index 000000000..21f9cada2 --- /dev/null +++ b/packages/react/src/pages/org.tsx @@ -0,0 +1,480 @@ +import { useReducer, useState } from "react"; +import { Exit, Match } from "effect"; +import { useAtomValue, useAtomSet } from "@effect/atom-react"; +import * as AsyncResult from "effect/unstable/reactivity/AsyncResult"; +import { toast } from "sonner"; +import { orgMemberWriteKeys, orgInfoWriteKeys } from "../api/reactivity-keys"; +import { + Dialog, + DialogContent, + DialogHeader, + DialogTitle, + DialogDescription, + DialogFooter, + DialogClose, +} from "../components/dialog"; +import { Button } from "../components/button"; +import { Badge } from "../components/badge"; +import { Input } from "../components/input"; +import { Label } from "../components/label"; +import { + Select, + SelectContent, + SelectItem, + SelectTrigger, + SelectValue, +} from "../components/select"; +import { + DropdownMenu, + DropdownMenuContent, + DropdownMenuItem, + DropdownMenuSub, + DropdownMenuSubContent, + DropdownMenuSubTrigger, + DropdownMenuTrigger, + DropdownMenuSeparator, +} from "../components/dropdown-menu"; +import { + orgMembersAtom, + orgRolesAtom, + inviteMember, + removeMember, + updateMemberRole, + updateOrgName, +} from "../api/account-atoms"; +import { useAuth } from "../multiplayer/auth-context"; + +// --------------------------------------------------------------------------- +// Shared organization page — members + roles + invites + org name, over the +// provider-neutral `/account/*` surface. Cloud-only surfaces (domain +// verification, seat/billing gating) are NOT here; cloud composes those +// alongside this page as its own additions. +// --------------------------------------------------------------------------- + +type MemberData = { + id: string; + email: string; + name: string | null; + avatarUrl: string | null; + role: string; + status: string; + lastActiveAt: string | null; + isCurrentUser: boolean; +}; + +type RoleData = { slug: string; name: string }; + +type InviteState = { + email: string; + roleSlug: string; + status: "idle" | "sending" | "error"; +}; + +const initialInviteState: InviteState = { email: "", roleSlug: "member", status: "idle" }; + +type InviteAction = + | { type: "setEmail"; email: string } + | { type: "setRole"; roleSlug: string } + | { type: "send" } + | { type: "error" } + | { type: "reset" }; + +function inviteReducer(state: InviteState, action: InviteAction): InviteState { + return Match.value(action).pipe( + Match.discriminator("type")("setEmail", (a) => ({ ...state, email: a.email })), + Match.discriminator("type")("setRole", (a) => ({ ...state, roleSlug: a.roleSlug })), + Match.discriminator("type")("send", () => ({ ...state, status: "sending" as const })), + Match.discriminator("type")("error", () => ({ ...state, status: "error" as const })), + Match.discriminator("type")("reset", () => initialInviteState), + Match.exhaustive, + ); +} + +function formatLastActive(lastActiveAt: string | null): string { + if (!lastActiveAt) return "—"; + const date = new Date(lastActiveAt); + const diffMins = Math.floor((Date.now() - date.getTime()) / 60000); + if (diffMins < 1) return "Just now"; + if (diffMins < 60) return `${diffMins}m ago`; + const diffHours = Math.floor(diffMins / 60); + if (diffHours < 24) return `${diffHours}h ago`; + const diffDays = Math.floor(diffHours / 24); + if (diffDays < 30) return `${diffDays}d ago`; + return date.toLocaleDateString(undefined, { month: "short", day: "numeric" }); +} + +export function OrgPage() { + const auth = useAuth(); + const organizationName = + auth.status === "authenticated" ? (auth.organization?.name ?? "Organization") : "Organization"; + const membersResult = useAtomValue(orgMembersAtom); + const rolesResult = useAtomValue(orgRolesAtom); + const doRemove = useAtomSet(removeMember, { mode: "promiseExit" }); + const doUpdateRole = useAtomSet(updateMemberRole, { mode: "promiseExit" }); + const doUpdateOrgName = useAtomSet(updateOrgName, { mode: "promiseExit" }); + const [inviteOpen, setInviteOpen] = useState(false); + const [editName, setEditName] = useState(organizationName); + const [savingName, setSavingName] = useState(false); + const [search, setSearch] = useState(""); + + const roles = AsyncResult.match(rolesResult, { + onInitial: () => [] as readonly RoleData[], + onFailure: () => [] as readonly RoleData[], + onSuccess: ({ value }) => value.roles, + }); + + const handleRemove = async (membershipId: string, name: string) => { + const exit = await doRemove({ params: { membershipId }, reactivityKeys: orgMemberWriteKeys }); + toast[Exit.isSuccess(exit) ? "success" : "error"]( + Exit.isSuccess(exit) ? `Removed ${name}` : "Failed to remove member", + ); + }; + + const handleChangeRole = async (membershipId: string, roleSlug: string, roleName: string) => { + const exit = await doUpdateRole({ + params: { membershipId }, + payload: { roleSlug }, + reactivityKeys: orgMemberWriteKeys, + }); + toast[Exit.isSuccess(exit) ? "success" : "error"]( + Exit.isSuccess(exit) ? `Role changed to ${roleName}` : "Failed to change role", + ); + }; + + const handleSaveName = async () => { + const trimmed = editName.trim(); + if (!trimmed || trimmed === organizationName) { + setEditName(organizationName); + return; + } + setSavingName(true); + const exit = await doUpdateOrgName({ + payload: { name: trimmed }, + reactivityKeys: orgInfoWriteKeys, + }); + if (Exit.isSuccess(exit)) { + toast.success("Organization name updated"); + } else { + toast.error("Failed to update organization name"); + setEditName(organizationName); + } + setSavingName(false); + }; + + return ( +
+
+
+

Organization

+
+ +
+
+
+ + setEditName((e.target as HTMLInputElement).value)} + onKeyDown={(e) => { + if (e.key === "Enter") handleSaveName(); + }} + className="mt-1.5 h-9 text-sm" + /> +
+ {editName.trim() !== organizationName && editName.trim() !== "" && ( + + )} +
+
+ +
+
+
+

Members

+

+ People with access to this Executor instance. +

+
+ +
+ setSearch((e.target as HTMLInputElement).value)} + className="mb-3 h-9 text-sm" + /> + + {AsyncResult.match(membersResult, { + onInitial: () => ( +
+ {[1, 2, 3].map((i) => ( +
+ ))} +
+ ), + onFailure: () => ( +
+

Failed to load members

+
+ ), + onSuccess: ({ value }) => { + const members = value.members; + const filtered = search + ? members.filter( + (m: MemberData) => + m.email.toLowerCase().includes(search.toLowerCase()) || + (m.name?.toLowerCase().includes(search.toLowerCase()) ?? false), + ) + : members; + + if (filtered.length === 0) { + return ( +

+ {search ? "No matching members" : "No members yet"} +

+ ); + } + + return ( +
+ {filtered.map((member: MemberData) => ( +
+ {member.avatarUrl ? ( + + ) : ( +
+ {member.name + ? member.name + .split(" ") + .map((n: string) => n[0]) + .join("") + .slice(0, 2) + .toUpperCase() + : member.email[0]!.toUpperCase()} +
+ )} + +
+
+

+ {member.name ?? member.email} +

+ {member.isCurrentUser && ( + You + )} + {member.status === "pending" && ( + + Invited + + )} +
+ {member.name && ( +

+ {member.email} +

+ )} +
+ +

+ {member.role} +

+ +

+ {formatLastActive(member.lastActiveAt)} +

+ + {!member.isCurrentUser ? ( + + + + + + {roles.length > 0 && ( + <> + + + Change role + + + {roles.map((role: RoleData) => ( + + handleChangeRole(member.id, role.slug, role.name) + } + > + {role.name} + + ))} + + + + + )} + handleRemove(member.id, member.name ?? member.email)} + > + Remove member + + + + ) : ( +
+ )} +
+ ))} +
+ ); + }, + })} +
+ + +
+
+ ); +} + +function InviteDialog(props: { + open: boolean; + onOpenChange: (v: boolean) => void; + roles: readonly RoleData[]; +}) { + const [state, dispatch] = useReducer(inviteReducer, initialInviteState); + const doInvite = useAtomSet(inviteMember, { mode: "promiseExit" }); + + const handleInvite = async () => { + if (!state.email.trim()) return; + dispatch({ type: "send" }); + const exit = await doInvite({ + payload: { + email: state.email.trim(), + ...(state.roleSlug ? { roleSlug: state.roleSlug } : {}), + }, + reactivityKeys: orgMemberWriteKeys, + }); + if (Exit.isSuccess(exit)) { + toast.success(`Invitation sent to ${state.email.trim()}`); + dispatch({ type: "reset" }); + props.onOpenChange(false); + return; + } + dispatch({ type: "error" }); + }; + + return ( + { + if (!v) dispatch({ type: "reset" }); + props.onOpenChange(v); + }} + > + + + Invite member + + Send an email invitation to join your organization. + + + +
+
+ + + dispatch({ type: "setEmail", email: (e.target as HTMLInputElement).value }) + } + onKeyDown={(e) => { + if (e.key === "Enter") handleInvite(); + }} + className="text-sm h-9" + /> +
+ + {props.roles.length > 0 && ( +
+ + +
+ )} + + {state.status === "error" && ( +
+

+ Failed to send invitation. Please try again. +

+
+ )} +
+ + + + + + + + + + ); +} From ee722dc3c4071f882e9dcd554b1aae0917ad21fe Mon Sep 17 00:00:00 2001 From: Rhys Sullivan Date: Sat, 30 May 2026 14:35:34 -0700 Subject: [PATCH 02/31] Make app file layouts consistent across cloud, self-host, and local Give all three apps one shared skeleton so structure matches how clean the composition already is: app.ts (the ExecutorApp.make root) + entry + barrel at src root, seam folders (auth/, db/, mcp/, account/), plugins.ts, observability, and testing/ for test scaffolding. - local: un-nest the whole app out of src/server/ up to src/, and group the libSQL/migration cluster into db/ (matching self-host's db/). - cloud: dissolve the api/ + services/ double grab-bag. Provider impls move to their seams (db/, engine/, mcp/, auth/, observability/); the billing extension to extensions/billing/; PluginsProvider to plugins.ts; api/ now holds only the typed-API composition glue (router, protected, layers, core-shared-services, error-response). Root loosies move home: jwks-cache to auth/, observability.ts to observability/, test scaffolding to testing/. - Point the executor-schema lint allowlist, wrangler test-worker entry, and miniflare unstable_dev path at the new locations. Behavior-neutral: format, lint, typecheck (36/36), and the local, self-host, and cloud (workerd + node + miniflare e2e) suites all pass. --- apps/cloud/src/account/account-api.ts | 4 +- .../member-limits.node.test.ts | 2 +- .../organization-limits.node.test.ts | 2 +- .../account/workos-account-service.test.ts | 2 +- .../src/account/workos-account-service.ts | 4 +- apps/cloud/src/api/layers.ts | 8 +- apps/cloud/src/api/protected.test.ts | 2 +- apps/cloud/src/api/protected.ts | 8 +- apps/cloud/src/api/router.ts | 8 +- .../secrets-api.node.test.ts | 2 +- .../sources-api.node.test.ts | 2 +- .../sources-refresh.node.test.ts | 2 +- .../tenant-isolation.node.test.ts | 2 +- apps/cloud/src/app.ts | 18 +- .../auth-tool-failures.node.test.ts | 2 +- .../src/auth/cloud-auth-api.test-context.ts | 2 +- apps/cloud/src/auth/context.ts | 4 +- .../auth/create-organization.e2e.node.test.ts | 2 +- apps/cloud/src/auth/handlers.ts | 4 +- .../src/{ => auth}/jwks-cache.node.test.ts | 0 apps/cloud/src/{ => auth}/jwks-cache.ts | 0 apps/cloud/src/auth/organization.ts | 2 +- .../src/{services => auth}/user-store.ts | 4 +- .../src/{services => db}/db.schema.test.ts | 0 apps/cloud/src/{services => db}/db.test.ts | 2 +- apps/cloud/src/{services => db}/db.ts | 2 +- apps/cloud/src/db/executor-schema.ts | 229 ++++++++++++++++++ apps/cloud/src/{services => db}/fuma.ts | 0 .../fumadb-cutover-migration.node.test.ts | 0 apps/cloud/src/{services => db}/schema.ts | 0 .../execution-stack-metered.ts | 8 +- .../{services => engine}/execution-stack.ts | 12 +- .../src/{api => engine}/execution-usage.ts | 0 .../billing/plans.ts} | 2 +- .../autumn.ts => extensions/billing/route.ts} | 8 +- .../billing/service.test-layer.ts} | 2 +- .../billing/service.ts} | 0 apps/cloud/src/{api => extensions}/docs.ts | 2 +- .../routes.ts} | 16 +- apps/cloud/src/mcp-flow.test.ts | 2 +- apps/cloud/src/mcp-miniflare.e2e.node.test.ts | 6 +- apps/cloud/src/mcp-session.e2e.node.test.ts | 6 +- apps/cloud/src/mcp/auth.ts | 4 +- .../cloud/src/{ => mcp}/mcp-auth.node.test.ts | 6 +- .../{services => mcp}/mcp-oauth.node.test.ts | 2 +- apps/cloud/src/mcp/session-durable-object.ts | 10 +- .../worker-transport.test.ts} | 2 +- .../worker-transport.ts} | 0 .../{api => observability}/error-logging.ts | 0 .../index.ts} | 0 .../{ => observability}/observability.test.ts | 2 +- .../{services => observability}/telemetry.ts | 0 apps/cloud/src/org/handlers.ts | 2 +- .../src/{api/cloud-plugins.ts => plugins.ts} | 2 +- apps/cloud/src/routes/__root.tsx | 2 +- .../src/secrets-isolation.e2e.node.test.ts | 2 +- apps/cloud/src/server.ts | 6 +- apps/cloud/src/services/executor-schema.ts | 165 ------------- .../api-harness.ts | 8 +- apps/cloud/src/{ => testing}/test-bearer.ts | 2 +- apps/cloud/src/{ => testing}/test-worker.ts | 16 +- apps/cloud/wrangler.miniflare.jsonc | 2 +- apps/cloud/wrangler.test.jsonc | 2 +- apps/local/src/{server => }/app.ts | 0 .../{server => }/auth-tool-failures.test.ts | 2 +- .../src/{server => db}/db-upgrade.test.ts | 2 +- apps/local/src/{server => db}/db-upgrade.ts | 0 .../{server => db}/embedded-migrations.gen.ts | 0 .../src/{server => db}/executor-schema.ts | 0 ...google-discovery-openapi-migration.test.ts | 0 .../google-discovery-openapi-migration.ts | 0 apps/local/src/{server => db}/libsql.ts | 0 .../migrate-google-discovery-bindings.test.ts | 4 +- .../migrate-graphql-bindings.test.ts | 4 +- .../migrate-mcp-bindings.test.ts | 4 +- .../migrate-oauth-connections.test.ts | 2 +- .../migrate-openapi-bindings.test.ts | 4 +- .../{server => db}/migration-nesting.test.ts | 0 .../local/src/{server => db}/sqlite-fumadb.ts | 0 .../src/{server => db}/sqlite-import.test.ts | 4 +- .../local/src/{server => db}/sqlite-import.ts | 0 apps/local/src/{server => }/executor.ts | 16 +- apps/local/src/{server => }/identity.ts | 0 apps/local/src/index.ts | 6 +- apps/local/src/{server => }/installation.ts | 2 +- apps/local/src/{server => }/integrations.ts | 0 apps/local/src/{server => }/main.ts | 0 .../{server => }/mcp-browser-resume.test.ts | 2 +- apps/local/src/{server => }/mcp-oauth.test.ts | 2 +- apps/local/src/{server => }/mcp.ts | 0 apps/local/src/{server => }/observability.ts | 0 apps/local/src/serve.ts | 4 +- .../libsql-test-db.ts | 0 .../pre-0007-schema.ts | 0 apps/local/vite.config.ts | 6 +- .../no-direct-cloud-executor-schema-import.js | 11 +- 96 files changed, 374 insertions(+), 319 deletions(-) rename apps/cloud/src/{services => account}/member-limits.node.test.ts (97%) rename apps/cloud/src/{services => account}/organization-limits.node.test.ts (98%) rename apps/cloud/src/{services => api}/secrets-api.node.test.ts (98%) rename apps/cloud/src/{services => api}/sources-api.node.test.ts (99%) rename apps/cloud/src/{services => api}/sources-refresh.node.test.ts (98%) rename apps/cloud/src/{services => api}/tenant-isolation.node.test.ts (99%) rename apps/cloud/src/{services => auth}/auth-tool-failures.node.test.ts (97%) rename apps/cloud/src/{ => auth}/jwks-cache.node.test.ts (100%) rename apps/cloud/src/{ => auth}/jwks-cache.ts (100%) rename apps/cloud/src/{services => auth}/user-store.ts (94%) rename apps/cloud/src/{services => db}/db.schema.test.ts (100%) rename apps/cloud/src/{services => db}/db.test.ts (98%) rename apps/cloud/src/{services => db}/db.ts (97%) create mode 100644 apps/cloud/src/db/executor-schema.ts rename apps/cloud/src/{services => db}/fuma.ts (100%) rename apps/cloud/src/{services => db}/fumadb-cutover-migration.node.test.ts (100%) rename apps/cloud/src/{services => db}/schema.ts (100%) rename apps/cloud/src/{api => engine}/execution-stack-metered.ts (89%) rename apps/cloud/src/{services => engine}/execution-stack.ts (93%) rename apps/cloud/src/{api => engine}/execution-usage.ts (100%) rename apps/cloud/src/{services/autumn-plans.ts => extensions/billing/plans.ts} (98%) rename apps/cloud/src/{api/autumn.ts => extensions/billing/route.ts} (90%) rename apps/cloud/src/{services/autumn.test-layer.ts => extensions/billing/service.test-layer.ts} (94%) rename apps/cloud/src/{services/autumn.ts => extensions/billing/service.ts} (100%) rename apps/cloud/src/{api => extensions}/docs.ts (93%) rename apps/cloud/src/{api/extension-routes.ts => extensions/routes.ts} (89%) rename apps/cloud/src/{ => mcp}/mcp-auth.node.test.ts (97%) rename apps/cloud/src/{services => mcp}/mcp-oauth.node.test.ts (99%) rename apps/cloud/src/{services/mcp-worker-transport.test.ts => mcp/worker-transport.test.ts} (99%) rename apps/cloud/src/{services/mcp-worker-transport.ts => mcp/worker-transport.ts} (100%) rename apps/cloud/src/{api => observability}/error-logging.ts (100%) rename apps/cloud/src/{observability.ts => observability/index.ts} (100%) rename apps/cloud/src/{ => observability}/observability.test.ts (97%) rename apps/cloud/src/{services => observability}/telemetry.ts (100%) rename apps/cloud/src/{api/cloud-plugins.ts => plugins.ts} (94%) delete mode 100644 apps/cloud/src/services/executor-schema.ts rename apps/cloud/src/{services/__test-harness__ => testing}/api-harness.ts (98%) rename apps/cloud/src/{ => testing}/test-bearer.ts (95%) rename apps/cloud/src/{ => testing}/test-worker.ts (92%) rename apps/local/src/{server => }/app.ts (100%) rename apps/local/src/{server => }/auth-tool-failures.test.ts (99%) rename apps/local/src/{server => db}/db-upgrade.test.ts (99%) rename apps/local/src/{server => db}/db-upgrade.ts (100%) rename apps/local/src/{server => db}/embedded-migrations.gen.ts (100%) rename apps/local/src/{server => db}/executor-schema.ts (100%) rename apps/local/src/{server => db}/google-discovery-openapi-migration.test.ts (100%) rename apps/local/src/{server => db}/google-discovery-openapi-migration.ts (100%) rename apps/local/src/{server => db}/libsql.ts (100%) rename apps/local/src/{server => db}/migrate-google-discovery-bindings.test.ts (97%) rename apps/local/src/{server => db}/migrate-graphql-bindings.test.ts (98%) rename apps/local/src/{server => db}/migrate-mcp-bindings.test.ts (97%) rename apps/local/src/{server => db}/migrate-oauth-connections.test.ts (99%) rename apps/local/src/{server => db}/migrate-openapi-bindings.test.ts (98%) rename apps/local/src/{server => db}/migration-nesting.test.ts (100%) rename apps/local/src/{server => db}/sqlite-fumadb.ts (100%) rename apps/local/src/{server => db}/sqlite-import.test.ts (99%) rename apps/local/src/{server => db}/sqlite-import.ts (100%) rename apps/local/src/{server => }/executor.ts (98%) rename apps/local/src/{server => }/identity.ts (100%) rename apps/local/src/{server => }/installation.ts (95%) rename apps/local/src/{server => }/integrations.ts (100%) rename apps/local/src/{server => }/main.ts (100%) rename apps/local/src/{server => }/mcp-browser-resume.test.ts (99%) rename apps/local/src/{server => }/mcp-oauth.test.ts (99%) rename apps/local/src/{server => }/mcp.ts (100%) rename apps/local/src/{server => }/observability.ts (100%) rename apps/local/src/{server/__test-helpers__ => testing}/libsql-test-db.ts (100%) rename apps/local/src/{server/__test-helpers__ => testing}/pre-0007-schema.ts (100%) diff --git a/apps/cloud/src/account/account-api.ts b/apps/cloud/src/account/account-api.ts index 38ed1faaa..94f434278 100644 --- a/apps/cloud/src/account/account-api.ts +++ b/apps/cloud/src/account/account-api.ts @@ -11,8 +11,8 @@ import { ApiKeyService } from "../auth/api-keys"; import { UserStoreService } from "../auth/context"; import { sessionFromSealed, type Session } from "../auth/middleware"; import { WorkOSClient } from "../auth/workos"; -import { AutumnService } from "../services/autumn"; -import { DbService } from "../services/db"; +import { AutumnService } from "../extensions/billing/service"; +import { DbService } from "../db/db"; import { AccountCaller, workosAccountProvider } from "./workos-account-service"; // --------------------------------------------------------------------------- diff --git a/apps/cloud/src/services/member-limits.node.test.ts b/apps/cloud/src/account/member-limits.node.test.ts similarity index 97% rename from apps/cloud/src/services/member-limits.node.test.ts rename to apps/cloud/src/account/member-limits.node.test.ts index 08ca67e74..b044ee5e7 100644 --- a/apps/cloud/src/services/member-limits.node.test.ts +++ b/apps/cloud/src/account/member-limits.node.test.ts @@ -1,6 +1,6 @@ import { describe, expect, it } from "@effect/vitest"; -import { getMemberLimitForPlan, selectActiveMemberLimitPlan } from "./autumn-plans"; +import { getMemberLimitForPlan, selectActiveMemberLimitPlan } from "../extensions/billing/plans"; describe("member limits", () => { it("uses an active or trialing subscription before older entries", () => { diff --git a/apps/cloud/src/services/organization-limits.node.test.ts b/apps/cloud/src/account/organization-limits.node.test.ts similarity index 98% rename from apps/cloud/src/services/organization-limits.node.test.ts rename to apps/cloud/src/account/organization-limits.node.test.ts index 2ae58f25b..f957a314b 100644 --- a/apps/cloud/src/services/organization-limits.node.test.ts +++ b/apps/cloud/src/account/organization-limits.node.test.ts @@ -5,7 +5,7 @@ import { hasPaidOrganizationSubscription, isOverFreeOrganizationLimit, shouldApplyFreeOrganizationLimit, -} from "./autumn-plans"; +} from "../extensions/billing/plans"; describe("organization limits", () => { it("treats active and trialing paid org subscriptions as paid", () => { diff --git a/apps/cloud/src/account/workos-account-service.test.ts b/apps/cloud/src/account/workos-account-service.test.ts index 7bb088f33..4b6e0c36f 100644 --- a/apps/cloud/src/account/workos-account-service.test.ts +++ b/apps/cloud/src/account/workos-account-service.test.ts @@ -10,7 +10,7 @@ import { ApiKeyService } from "../auth/api-keys"; import { UserStoreService } from "../auth/context"; import type { Session } from "../auth/middleware"; import { WorkOSClient, type WorkOSClientService } from "../auth/workos"; -import { AutumnService } from "../services/autumn"; +import { AutumnService } from "../extensions/billing/service"; import { AccountCaller, workosAccountProvider } from "./workos-account-service"; // --------------------------------------------------------------------------- diff --git a/apps/cloud/src/account/workos-account-service.ts b/apps/cloud/src/account/workos-account-service.ts index 917ea3885..4958ca0bd 100644 --- a/apps/cloud/src/account/workos-account-service.ts +++ b/apps/cloud/src/account/workos-account-service.ts @@ -13,8 +13,8 @@ import { UserStoreService } from "../auth/context"; import type { Session } from "../auth/middleware"; import { WorkOSClient } from "../auth/workos"; import { authorizeOrganization } from "../auth/organization"; -import { AutumnService } from "../services/autumn"; -import { getMemberLimitForPlan, selectActiveMemberLimitPlan } from "../services/autumn-plans"; +import { AutumnService } from "../extensions/billing/service"; +import { getMemberLimitForPlan, selectActiveMemberLimitPlan } from "../extensions/billing/plans"; // The per-request resolved caller, injected by the cookie-only session // middleware in `account-api.ts`. Carries the authenticated WorkOS session, or diff --git a/apps/cloud/src/api/layers.ts b/apps/cloud/src/api/layers.ts index ae7f32856..9b3c2dff5 100644 --- a/apps/cloud/src/api/layers.ts +++ b/apps/cloud/src/api/layers.ts @@ -11,15 +11,15 @@ import { CloudSessionAuthHandlers, NonProtectedApi, } from "../auth/handlers"; -import { DbService } from "../services/db"; -import { WorkerTelemetryLive } from "../services/telemetry"; +import { DbService } from "../db/db"; +import { WorkerTelemetryLive } from "../observability/telemetry"; import { OrgHttpApi } from "../org/api"; import { OrgHandlers } from "../org/handlers"; import { ErrorCaptureLive } from "../observability"; -import { AutumnService } from "../services/autumn"; +import { AutumnService } from "../extensions/billing/service"; -import { cloudPlugins } from "./cloud-plugins"; +import { cloudPlugins } from "../plugins"; import { CoreSharedServices } from "./core-shared-services"; const DbLive = DbService.Live; diff --git a/apps/cloud/src/api/protected.test.ts b/apps/cloud/src/api/protected.test.ts index 66595f5ec..5a1a02283 100644 --- a/apps/cloud/src/api/protected.test.ts +++ b/apps/cloud/src/api/protected.test.ts @@ -1,7 +1,7 @@ import { describe, expect, it } from "@effect/vitest"; import { Effect } from "effect"; import type { ExecutionEngine } from "@executor-js/execution"; -import { withExecutionUsageTracking } from "./execution-usage"; +import { withExecutionUsageTracking } from "../engine/execution-usage"; const makeBaseEngine = (): ExecutionEngine => ({ diff --git a/apps/cloud/src/api/protected.ts b/apps/cloud/src/api/protected.ts index 47022427e..ffe8b36c1 100644 --- a/apps/cloud/src/api/protected.ts +++ b/apps/cloud/src/api/protected.ts @@ -12,14 +12,14 @@ import { type IdentityFailure, } from "@executor-js/api/server"; -import { cloudPlugins, type CloudPlugins } from "./cloud-plugins"; +import { cloudPlugins, type CloudPlugins } from "../plugins"; import { ApiKeyService } from "../auth/api-keys"; import { UserStoreService } from "../auth/context"; import { cloudIdentityFailureStrategy, workosIdentityLayer } from "../auth/workos-auth-provider"; -import { AutumnService } from "../services/autumn"; -import { DbService } from "../services/db"; +import { AutumnService } from "../extensions/billing/service"; +import { DbService } from "../db/db"; import { CoreSharedServices } from "./core-shared-services"; -import { CloudMeteredExecutionStackLayer } from "./execution-stack-metered"; +import { CloudMeteredExecutionStackLayer } from "../engine/execution-stack-metered"; import { ProtectedCloudApiLive, RequestScopedServicesLive } from "./layers"; // Re-exported for `protected-api-key-auth.node.test.ts`, which asserts the diff --git a/apps/cloud/src/api/router.ts b/apps/cloud/src/api/router.ts index 49cf9004f..91b6f4895 100644 --- a/apps/cloud/src/api/router.ts +++ b/apps/cloud/src/api/router.ts @@ -4,12 +4,12 @@ import { HttpRouter } from "effect/unstable/http"; import { RouterConfigLive } from "@executor-js/api/server"; import { UserStoreService } from "../auth/context"; -import { DbService } from "../services/db"; +import { DbService } from "../db/db"; import { makeAccountApiLive } from "../account/account-api"; -import { AutumnRoutesLive } from "./autumn"; -import { CloudDocsLive } from "./docs"; -import { ApiErrorLoggingLive } from "./error-logging"; +import { AutumnRoutesLive } from "../extensions/billing/route"; +import { CloudDocsLive } from "../extensions/docs"; +import { ApiErrorLoggingLive } from "../observability/error-logging"; import { BootSharedServices, OrgApiLive, diff --git a/apps/cloud/src/services/secrets-api.node.test.ts b/apps/cloud/src/api/secrets-api.node.test.ts similarity index 98% rename from apps/cloud/src/services/secrets-api.node.test.ts rename to apps/cloud/src/api/secrets-api.node.test.ts index 87cbbe211..28c94efb1 100644 --- a/apps/cloud/src/services/secrets-api.node.test.ts +++ b/apps/cloud/src/api/secrets-api.node.test.ts @@ -6,7 +6,7 @@ import { Effect, Result } from "effect"; import { ScopeId, SecretId } from "@executor-js/sdk"; -import { asOrg, fetchForOrg, TEST_BASE_URL } from "./__test-harness__/api-harness"; +import { asOrg, fetchForOrg, TEST_BASE_URL } from "../testing/api-harness"; describe("secrets api (HTTP)", () => { it.effect("set → list → status returns secret metadata", () => diff --git a/apps/cloud/src/services/sources-api.node.test.ts b/apps/cloud/src/api/sources-api.node.test.ts similarity index 99% rename from apps/cloud/src/services/sources-api.node.test.ts rename to apps/cloud/src/api/sources-api.node.test.ts index 24ccfdb06..6b5a39c7c 100644 --- a/apps/cloud/src/services/sources-api.node.test.ts +++ b/apps/cloud/src/api/sources-api.node.test.ts @@ -22,7 +22,7 @@ import { } from "@executor-js/plugin-openapi/testing"; import { secretsForCredentialTarget } from "@executor-js/react/plugins/secret-header-auth"; -import { asOrg, asUser, testUserOrgScopeId } from "./__test-harness__/api-harness"; +import { asOrg, asUser, testUserOrgScopeId } from "../testing/api-harness"; const isJsonObject = (value: unknown): value is Record => typeof value === "object" && value !== null && !Array.isArray(value); diff --git a/apps/cloud/src/services/sources-refresh.node.test.ts b/apps/cloud/src/api/sources-refresh.node.test.ts similarity index 98% rename from apps/cloud/src/services/sources-refresh.node.test.ts rename to apps/cloud/src/api/sources-refresh.node.test.ts index a615397ff..63e2d68b4 100644 --- a/apps/cloud/src/services/sources-refresh.node.test.ts +++ b/apps/cloud/src/api/sources-refresh.node.test.ts @@ -14,7 +14,7 @@ import { serveMutableOpenApiSpecTestServer, } from "@executor-js/plugin-openapi/testing"; -import { asOrg } from "./__test-harness__/api-harness"; +import { asOrg } from "../testing/api-harness"; const PingEndpoint = HttpApiEndpoint.get("ping", "/ping", { success: Schema.Unknown }); const PongEndpoint = HttpApiEndpoint.get("pong", "/pong", { success: Schema.Unknown }); diff --git a/apps/cloud/src/services/tenant-isolation.node.test.ts b/apps/cloud/src/api/tenant-isolation.node.test.ts similarity index 99% rename from apps/cloud/src/services/tenant-isolation.node.test.ts rename to apps/cloud/src/api/tenant-isolation.node.test.ts index b1c850db6..da2e5b8d2 100644 --- a/apps/cloud/src/services/tenant-isolation.node.test.ts +++ b/apps/cloud/src/api/tenant-isolation.node.test.ts @@ -9,7 +9,7 @@ import { HttpApi, HttpApiEndpoint, HttpApiGroup, OpenApi } from "effect/unstable import { ConnectionId, ScopeId, SecretId } from "@executor-js/sdk"; import { makeOpenApiHttpApiTestAddSpecPayload } from "@executor-js/plugin-openapi/testing"; -import { asOrg } from "./__test-harness__/api-harness"; +import { asOrg } from "../testing/api-harness"; const PingGroup = HttpApiGroup.make("default", { topLevel: true }).add( HttpApiEndpoint.get("ping", "/ping", { success: Schema.Unknown }), diff --git a/apps/cloud/src/app.ts b/apps/cloud/src/app.ts index fc42ed6a3..9f0230702 100644 --- a/apps/cloud/src/app.ts +++ b/apps/cloud/src/app.ts @@ -3,26 +3,26 @@ import { HttpServer } from "effect/unstable/http"; import { DbProvider, ExecutorApp } from "@executor-js/api/server"; -import { cloudPlugins } from "./api/cloud-plugins"; +import { cloudPlugins } from "./plugins"; import { CoreSharedServices } from "./api/core-shared-services"; -import { makeCloudExtensionRoutes } from "./api/extension-routes"; +import { makeCloudExtensionRoutes } from "./extensions/routes"; import { RequestScopedServicesLive } from "./api/layers"; -import { CloudMeteringEngineDecorator } from "./api/execution-stack-metered"; +import { CloudMeteringEngineDecorator } from "./engine/execution-stack-metered"; import { workosAccountMiddleware } from "./account/account-api"; import { ApiKeyService } from "./auth/api-keys"; import { cloudIdentityFailureStrategy, workosIdentityLayer } from "./auth/workos-auth-provider"; -import { DbService } from "./services/db"; +import { DbService } from "./db/db"; import { cloudMcpAuth, cloudMcpReporter, cloudMcpSessions } from "./mcp"; import { McpSessionDO } from "./mcp/session-durable-object"; import { ErrorCaptureLive } from "./observability"; -import { AutumnService } from "./services/autumn"; +import { AutumnService } from "./extensions/billing/service"; import { CloudCodeExecutorProvider, CloudDbProvider, CloudHostConfig, CloudPluginsProvider, -} from "./services/execution-stack"; -import { WorkerTelemetryLive } from "./services/telemetry"; +} from "./engine/execution-stack"; +import { WorkerTelemetryLive } from "./observability/telemetry"; // =========================================================================== // The Executor CLOUD app, as ONE `ExecutorApp.make` call. @@ -32,7 +32,7 @@ import { WorkerTelemetryLive } from "./services/telemetry"; // the Cloudflare dynamic-worker code substrate, MCP served by a Durable-Object // session store (the DO surfaced via `config.mcpExport`), console+Sentry error // capture — and Autumn BILLING entering ONLY as extensions: the engine -// metering decorator, the account seat-gate, the `/api/autumn/*` proxy route, +// metering decorator, the account seat-gate, the `/extensions/billing/route/*` proxy route, // and the createOrganization free-limit gate. `diff` against // `apps/host-selfhost/src/app.ts` is the entire product difference. // @@ -135,5 +135,5 @@ export const CloudAppLayer = appLayer; export const cloudMcpExport = mcpExport; // The unified cloud web handler: serves /api/*, /api/auth/*, /mcp, -// /.well-known/*, /api/docs — everything the worker dispatches. +// /.well-known/*, /extensions/docs — everything the worker dispatches. export const cloudApiHandler = toWebHandler; diff --git a/apps/cloud/src/services/auth-tool-failures.node.test.ts b/apps/cloud/src/auth/auth-tool-failures.node.test.ts similarity index 97% rename from apps/cloud/src/services/auth-tool-failures.node.test.ts rename to apps/cloud/src/auth/auth-tool-failures.node.test.ts index 37f1b8a48..87f10caa4 100644 --- a/apps/cloud/src/services/auth-tool-failures.node.test.ts +++ b/apps/cloud/src/auth/auth-tool-failures.node.test.ts @@ -19,7 +19,7 @@ import { HttpApi, HttpApiClient, HttpApiEndpoint, HttpApiGroup } from "effect/un import { ScopeId } from "@executor-js/sdk"; import { makeOpenApiHttpApiTestAddSpecPayload } from "@executor-js/plugin-openapi/testing"; -import { ProtectedCloudApi, asOrg } from "./__test-harness__/api-harness"; +import { ProtectedCloudApi, asOrg } from "../testing/api-harness"; const PingGroup = HttpApiGroup.make("default", { topLevel: true }).add( HttpApiEndpoint.get("ping", "/ping", { success: Schema.Unknown }), diff --git a/apps/cloud/src/auth/cloud-auth-api.test-context.ts b/apps/cloud/src/auth/cloud-auth-api.test-context.ts index c81d6377e..8beb69b02 100644 --- a/apps/cloud/src/auth/cloud-auth-api.test-context.ts +++ b/apps/cloud/src/auth/cloud-auth-api.test-context.ts @@ -7,7 +7,7 @@ import { AutumnTestLayer, makeAutumnTestState, type AutumnTestState, -} from "../services/autumn.test-layer"; +} from "../extensions/billing/service.test-layer"; import { ApiKeyServiceTestLayer } from "./api-keys.test-layer"; import { makeUserStoreTestState, diff --git a/apps/cloud/src/auth/context.ts b/apps/cloud/src/auth/context.ts index 933a9ea65..e76272592 100644 --- a/apps/cloud/src/auth/context.ts +++ b/apps/cloud/src/auth/context.ts @@ -1,6 +1,6 @@ import { Context, Effect, Layer } from "effect"; -import { makeUserStore } from "../services/user-store"; -import { DbService } from "../services/db"; +import { makeUserStore } from "../auth/user-store"; +import { DbService } from "../db/db"; import { UserStoreError, tryPromiseService, withServiceLogging } from "./errors"; // --------------------------------------------------------------------------- diff --git a/apps/cloud/src/auth/create-organization.e2e.node.test.ts b/apps/cloud/src/auth/create-organization.e2e.node.test.ts index 8685dd7c4..8cdaedd57 100644 --- a/apps/cloud/src/auth/create-organization.e2e.node.test.ts +++ b/apps/cloud/src/auth/create-organization.e2e.node.test.ts @@ -7,7 +7,7 @@ import { makeCloudAuthApiTestState, } from "./cloud-auth-api.test-context"; import { makeWorkOSTestMembership, makeWorkOSTestState } from "./workos.test-layer"; -import { makeAutumnTestState } from "../services/autumn.test-layer"; +import { makeAutumnTestState } from "../extensions/billing/service.test-layer"; describe("create organization API", () => { it.effect("lets a paid user create another organization through the HTTP API client", () => { diff --git a/apps/cloud/src/auth/handlers.ts b/apps/cloud/src/auth/handlers.ts index c4d395072..0ac1a515f 100644 --- a/apps/cloud/src/auth/handlers.ts +++ b/apps/cloud/src/auth/handlers.ts @@ -16,12 +16,12 @@ import { UserStoreService } from "./context"; import { env } from "cloudflare:workers"; import { WorkOSError } from "./errors"; import { WorkOSClient } from "./workos"; -import { AutumnService } from "../services/autumn"; +import { AutumnService } from "../extensions/billing/service"; import { hasPaidOrganizationSubscription, isOverFreeOrganizationLimit, shouldApplyFreeOrganizationLimit, -} from "../services/autumn-plans"; +} from "../extensions/billing/plans"; import { authorizeOrganization } from "./organization"; import type { McpSessionApprovalResult, diff --git a/apps/cloud/src/jwks-cache.node.test.ts b/apps/cloud/src/auth/jwks-cache.node.test.ts similarity index 100% rename from apps/cloud/src/jwks-cache.node.test.ts rename to apps/cloud/src/auth/jwks-cache.node.test.ts diff --git a/apps/cloud/src/jwks-cache.ts b/apps/cloud/src/auth/jwks-cache.ts similarity index 100% rename from apps/cloud/src/jwks-cache.ts rename to apps/cloud/src/auth/jwks-cache.ts diff --git a/apps/cloud/src/auth/organization.ts b/apps/cloud/src/auth/organization.ts index 7a1992f6d..a63733d57 100644 --- a/apps/cloud/src/auth/organization.ts +++ b/apps/cloud/src/auth/organization.ts @@ -8,7 +8,7 @@ // Deliberately billing-FREE: this module is reached by the MCP session DO bundle // (via `mcp/auth.ts`), which must not transitively import any billing config // (`autumn.config` / `atmn`). The free-organizations-per-user limit predicates — -// which DO depend on the Autumn plan config — live in `services/autumn-plans.ts`. +// which DO depend on the Autumn plan config — live in `extensions/billing/plans.ts`. // --------------------------------------------------------------------------- import { Effect } from "effect"; diff --git a/apps/cloud/src/services/user-store.ts b/apps/cloud/src/auth/user-store.ts similarity index 94% rename from apps/cloud/src/services/user-store.ts rename to apps/cloud/src/auth/user-store.ts index d5a4781f8..8af265eff 100644 --- a/apps/cloud/src/services/user-store.ts +++ b/apps/cloud/src/auth/user-store.ts @@ -9,8 +9,8 @@ import { eq } from "drizzle-orm"; -import { accounts, organizations } from "./schema"; -import type { DrizzleDb } from "./db"; +import { accounts, organizations } from "../db/schema"; +import type { DrizzleDb } from "../db/db"; export type Account = typeof accounts.$inferSelect; export type Organization = typeof organizations.$inferSelect; diff --git a/apps/cloud/src/services/db.schema.test.ts b/apps/cloud/src/db/db.schema.test.ts similarity index 100% rename from apps/cloud/src/services/db.schema.test.ts rename to apps/cloud/src/db/db.schema.test.ts diff --git a/apps/cloud/src/services/db.test.ts b/apps/cloud/src/db/db.test.ts similarity index 98% rename from apps/cloud/src/services/db.test.ts rename to apps/cloud/src/db/db.test.ts index 3ef41f35f..b437b4bf7 100644 --- a/apps/cloud/src/services/db.test.ts +++ b/apps/cloud/src/db/db.test.ts @@ -24,7 +24,7 @@ import { describe, it, expect } from "@effect/vitest"; import { Effect, Layer } from "effect"; import { DbService } from "./db"; -import { makeUserStore } from "./user-store"; +import { makeUserStore } from "../auth/user-store"; const program = (body: Effect.Effect) => Effect.runPromise( diff --git a/apps/cloud/src/services/db.ts b/apps/cloud/src/db/db.ts similarity index 97% rename from apps/cloud/src/services/db.ts rename to apps/cloud/src/db/db.ts index 75026bd5c..5610e4b2d 100644 --- a/apps/cloud/src/services/db.ts +++ b/apps/cloud/src/db/db.ts @@ -25,7 +25,7 @@ import * as executorSchema from "./executor-schema"; // Exported so every drizzle() call in the cloud app shares one schema // object. Historically `mcp-session.ts` built its own and forgot to spread // `executorSchema`, producing runtime "unknown model source" errors that -// only surfaced in prod. See apps/cloud/src/services/db.schema.test.ts. +// only surfaced in prod. See apps/cloud/src/db/db.schema.test.ts. export const combinedSchema = { ...cloudSchema, ...executorSchema }; // eslint-disable-next-line @typescript-eslint/no-explicit-any diff --git a/apps/cloud/src/db/executor-schema.ts b/apps/cloud/src/db/executor-schema.ts new file mode 100644 index 000000000..bc324c776 --- /dev/null +++ b/apps/cloud/src/db/executor-schema.ts @@ -0,0 +1,229 @@ +import { + pgTable, + varchar, + text, + boolean, + timestamp, + uniqueIndex, + json, + bigint, +} from "drizzle-orm/pg-core"; +import { createId } from "fumadb/cuid"; + +export const source = pgTable( + "source", + { + row_id: varchar("row_id", { length: 255 }) + .primaryKey() + .notNull() + .$defaultFn(() => createId()), + id: varchar("id", { length: 255 }).notNull(), + scope_id: varchar("scope_id", { length: 255 }).notNull(), + plugin_id: text("plugin_id").notNull(), + kind: text("kind").notNull(), + name: text("name").notNull(), + url: text("url"), + can_remove: boolean("can_remove").notNull().default(true), + can_refresh: boolean("can_refresh").notNull().default(false), + can_edit: boolean("can_edit").notNull().default(false), + created_at: timestamp("created_at").notNull(), + updated_at: timestamp("updated_at").notNull(), + }, + (table) => [uniqueIndex("source_scope_id_id_uidx").on(table.scope_id, table.id)], +); + +export const tool = pgTable( + "tool", + { + row_id: varchar("row_id", { length: 255 }) + .primaryKey() + .notNull() + .$defaultFn(() => createId()), + id: varchar("id", { length: 255 }).notNull(), + scope_id: varchar("scope_id", { length: 255 }).notNull(), + source_id: text("source_id").notNull(), + plugin_id: text("plugin_id").notNull(), + name: text("name").notNull(), + description: text("description").notNull(), + input_schema: json("input_schema"), + output_schema: json("output_schema"), + created_at: timestamp("created_at").notNull(), + updated_at: timestamp("updated_at").notNull(), + }, + (table) => [uniqueIndex("tool_scope_id_id_uidx").on(table.scope_id, table.id)], +); + +export const definition = pgTable( + "definition", + { + row_id: varchar("row_id", { length: 255 }) + .primaryKey() + .notNull() + .$defaultFn(() => createId()), + id: varchar("id", { length: 255 }).notNull(), + scope_id: varchar("scope_id", { length: 255 }).notNull(), + source_id: text("source_id").notNull(), + plugin_id: text("plugin_id").notNull(), + name: text("name").notNull(), + schema: json("schema").notNull(), + created_at: timestamp("created_at").notNull(), + }, + (table) => [uniqueIndex("definition_scope_id_id_uidx").on(table.scope_id, table.id)], +); + +export const secret = pgTable( + "secret", + { + row_id: varchar("row_id", { length: 255 }) + .primaryKey() + .notNull() + .$defaultFn(() => createId()), + id: varchar("id", { length: 255 }).notNull(), + scope_id: varchar("scope_id", { length: 255 }).notNull(), + name: text("name").notNull(), + provider: text("provider").notNull(), + owned_by_connection_id: text("owned_by_connection_id"), + created_at: timestamp("created_at").notNull(), + }, + (table) => [uniqueIndex("secret_scope_id_id_uidx").on(table.scope_id, table.id)], +); + +export const connection = pgTable( + "connection", + { + row_id: varchar("row_id", { length: 255 }) + .primaryKey() + .notNull() + .$defaultFn(() => createId()), + id: varchar("id", { length: 255 }).notNull(), + scope_id: varchar("scope_id", { length: 255 }).notNull(), + provider: text("provider").notNull(), + identity_label: text("identity_label"), + access_token_secret_id: text("access_token_secret_id").notNull(), + refresh_token_secret_id: text("refresh_token_secret_id"), + expires_at: bigint("expires_at", { mode: "bigint" }), + scope: text("scope"), + provider_state: json("provider_state"), + created_at: timestamp("created_at").notNull(), + updated_at: timestamp("updated_at").notNull(), + }, + (table) => [uniqueIndex("connection_scope_id_id_uidx").on(table.scope_id, table.id)], +); + +export const oauth2_session = pgTable( + "oauth2_session", + { + row_id: varchar("row_id", { length: 255 }) + .primaryKey() + .notNull() + .$defaultFn(() => createId()), + id: varchar("id", { length: 255 }).notNull(), + scope_id: varchar("scope_id", { length: 255 }).notNull(), + plugin_id: text("plugin_id").notNull(), + strategy: text("strategy").notNull(), + connection_id: text("connection_id").notNull(), + token_scope: text("token_scope").notNull(), + redirect_url: text("redirect_url").notNull(), + payload: json("payload").notNull(), + expires_at: bigint("expires_at", { mode: "bigint" }).notNull(), + created_at: timestamp("created_at").notNull(), + }, + (table) => [uniqueIndex("oauth2_session_scope_id_id_uidx").on(table.scope_id, table.id)], +); + +export const credential_binding = pgTable( + "credential_binding", + { + row_id: varchar("row_id", { length: 255 }) + .primaryKey() + .notNull() + .$defaultFn(() => createId()), + id: varchar("id", { length: 255 }).notNull(), + scope_id: varchar("scope_id", { length: 255 }).notNull(), + plugin_id: text("plugin_id").notNull(), + source_id: text("source_id").notNull(), + source_scope_id: text("source_scope_id").notNull(), + slot_key: text("slot_key").notNull(), + kind: text("kind").notNull(), + text_value: text("text_value"), + secret_id: text("secret_id"), + secret_scope_id: text("secret_scope_id"), + connection_id: text("connection_id"), + created_at: timestamp("created_at").notNull(), + updated_at: timestamp("updated_at").notNull(), + }, + (table) => [uniqueIndex("credential_binding_scope_id_id_uidx").on(table.scope_id, table.id)], +); + +export const plugin_storage = pgTable( + "plugin_storage", + { + row_id: varchar("row_id", { length: 255 }) + .primaryKey() + .notNull() + .$defaultFn(() => createId()), + id: varchar("id", { length: 255 }).notNull(), + scope_id: varchar("scope_id", { length: 255 }).notNull(), + plugin_id: text("plugin_id").notNull(), + collection: text("collection").notNull(), + key: text("key").notNull(), + data: json("data").notNull(), + created_at: timestamp("created_at").notNull(), + updated_at: timestamp("updated_at").notNull(), + }, + (table) => [uniqueIndex("plugin_storage_scope_id_id_uidx").on(table.scope_id, table.id)], +); + +export const tool_policy = pgTable( + "tool_policy", + { + row_id: varchar("row_id", { length: 255 }) + .primaryKey() + .notNull() + .$defaultFn(() => createId()), + id: varchar("id", { length: 255 }).notNull(), + scope_id: varchar("scope_id", { length: 255 }).notNull(), + pattern: text("pattern").notNull(), + action: text("action").notNull(), + position: text("position").notNull(), + created_at: timestamp("created_at").notNull(), + updated_at: timestamp("updated_at").notNull(), + }, + (table) => [uniqueIndex("tool_policy_scope_id_id_uidx").on(table.scope_id, table.id)], +); + +export const blob = pgTable( + "blob", + { + row_id: varchar("row_id", { length: 255 }) + .primaryKey() + .notNull() + .$defaultFn(() => createId()), + id: varchar("id", { length: 255 }).notNull(), + namespace: text("namespace").notNull(), + key: text("key").notNull(), + value: text("value").notNull(), + }, + (table) => [uniqueIndex("blob_id_uidx").on(table.id)], +); + +export const workos_vault_metadata = pgTable( + "workos_vault_metadata", + { + row_id: varchar("row_id", { length: 255 }) + .primaryKey() + .notNull() + .$defaultFn(() => createId()), + id: varchar("id", { length: 255 }).notNull(), + scope_id: varchar("scope_id", { length: 255 }).notNull(), + name: text("name").notNull(), + purpose: text("purpose"), + created_at: timestamp("created_at").notNull(), + }, + (table) => [uniqueIndex("workos_vault_metadata_scope_id_id_uidx").on(table.scope_id, table.id)], +); + +export const private_executor_cloud_settings = pgTable("private_executor_cloud_settings", { + id: varchar("id", { length: 255 }).primaryKey().notNull(), + version: varchar("version", { length: 255 }).notNull().default("1.0.0"), +}); diff --git a/apps/cloud/src/services/fuma.ts b/apps/cloud/src/db/fuma.ts similarity index 100% rename from apps/cloud/src/services/fuma.ts rename to apps/cloud/src/db/fuma.ts diff --git a/apps/cloud/src/services/fumadb-cutover-migration.node.test.ts b/apps/cloud/src/db/fumadb-cutover-migration.node.test.ts similarity index 100% rename from apps/cloud/src/services/fumadb-cutover-migration.node.test.ts rename to apps/cloud/src/db/fumadb-cutover-migration.node.test.ts diff --git a/apps/cloud/src/services/schema.ts b/apps/cloud/src/db/schema.ts similarity index 100% rename from apps/cloud/src/services/schema.ts rename to apps/cloud/src/db/schema.ts diff --git a/apps/cloud/src/api/execution-stack-metered.ts b/apps/cloud/src/engine/execution-stack-metered.ts similarity index 89% rename from apps/cloud/src/api/execution-stack-metered.ts rename to apps/cloud/src/engine/execution-stack-metered.ts index 18ba69aec..228ef70cd 100644 --- a/apps/cloud/src/api/execution-stack-metered.ts +++ b/apps/cloud/src/engine/execution-stack-metered.ts @@ -7,7 +7,7 @@ // overrides the base stack's no-op `EngineDecorator` with one that calls // `AutumnService.trackExecution` after each execution. // -// Keeping this in the cloud APP layer (not the neutral `services/execution-stack.ts`) +// Keeping this in the cloud APP layer (not the neutral `engine/execution-stack.ts`) // is the billing-boundary line: the neutral stack the DO shares names no billing // service; the metered overlay — provided ONLY here — does. // --------------------------------------------------------------------------- @@ -23,9 +23,9 @@ import { type EngineStackIdentity, } from "@executor-js/api/server"; -import { AutumnService } from "../services/autumn"; -import type { DbService } from "../services/db"; -import { CloudExecutionSeamsLayer } from "../services/execution-stack"; +import { AutumnService } from "../extensions/billing/service"; +import type { DbService } from "../db/db"; +import { CloudExecutionSeamsLayer } from "../engine/execution-stack"; import { withExecutionUsageTracking } from "./execution-usage"; // Usage-metering decorator bound to the billing service. `trackExecution` is diff --git a/apps/cloud/src/services/execution-stack.ts b/apps/cloud/src/engine/execution-stack.ts similarity index 93% rename from apps/cloud/src/services/execution-stack.ts rename to apps/cloud/src/engine/execution-stack.ts index 03bed7414..ea7ce4ca1 100644 --- a/apps/cloud/src/services/execution-stack.ts +++ b/apps/cloud/src/engine/execution-stack.ts @@ -26,7 +26,7 @@ // session DO never meters); the METERED stack (HTTP // executor plane only) overrides it with the billing // decorator (`CloudMeteredExecutionStackLayer`, -// ../api/execution-stack-metered.ts). Billing lives in +// ../engine/execution-stack-metered.ts). Billing lives in // the cloud app, not this neutral stack. // --------------------------------------------------------------------------- @@ -45,9 +45,9 @@ import { import { makeDynamicWorkerExecutor } from "@executor-js/runtime-dynamic-worker"; import executorConfig from "../../executor.config"; -import { cloudPlugins } from "../api/cloud-plugins"; -import { DbService } from "./db"; -import { cloudDbProviderLayer } from "./fuma"; +import { cloudPlugins } from "../plugins"; +import { DbService } from "../db/db"; +import { cloudDbProviderLayer } from "../db/fuma"; export { makeExecutionStack } from "@executor-js/api/server"; @@ -85,7 +85,7 @@ export const CloudCodeExecutorProvider: Layer.Layer = Laye * The four billing-free execution-stack seams (db / plugins / host-config / * code-executor) — everything `makeExecutionStack` reads EXCEPT the * `EngineDecorator`. The metered HTTP plane composes this with the billing - * decorator (../api/execution-stack-metered.ts); the neutral stack below adds + * decorator (../engine/execution-stack-metered.ts); the neutral stack below adds * the no-op decorator. Exported so the metered overlay builds over the SAME four * seams rather than relying on a layer override. */ @@ -108,7 +108,7 @@ export const CloudExecutionSeamsLayer: Layer.Layer< * in any billing service. * * The HTTP executor plane (the only path that meters) uses - * `CloudMeteredExecutionStackLayer` (../api/execution-stack-metered.ts), which + * `CloudMeteredExecutionStackLayer` (../engine/execution-stack-metered.ts), which * swaps the no-op decorator for the billing one. */ export const CloudExecutionStackLayer: Layer.Layer< diff --git a/apps/cloud/src/api/execution-usage.ts b/apps/cloud/src/engine/execution-usage.ts similarity index 100% rename from apps/cloud/src/api/execution-usage.ts rename to apps/cloud/src/engine/execution-usage.ts diff --git a/apps/cloud/src/services/autumn-plans.ts b/apps/cloud/src/extensions/billing/plans.ts similarity index 98% rename from apps/cloud/src/services/autumn-plans.ts rename to apps/cloud/src/extensions/billing/plans.ts index 750b61b13..2de6aa3ab 100644 --- a/apps/cloud/src/services/autumn-plans.ts +++ b/apps/cloud/src/extensions/billing/plans.ts @@ -1,4 +1,4 @@ -import { enterprise, team } from "../../autumn.config"; +import { enterprise, team } from "../../../autumn.config"; export const PAID_AUTUMN_PLAN_IDS = new Set([team.id, enterprise.id]); diff --git a/apps/cloud/src/api/autumn.ts b/apps/cloud/src/extensions/billing/route.ts similarity index 90% rename from apps/cloud/src/api/autumn.ts rename to apps/cloud/src/extensions/billing/route.ts index 584f9e7fb..53a3c2db5 100644 --- a/apps/cloud/src/api/autumn.ts +++ b/apps/cloud/src/extensions/billing/route.ts @@ -3,8 +3,8 @@ import { Cause, Effect } from "effect"; import { HttpRouter, HttpServerRequest, HttpServerResponse } from "effect/unstable/http"; import { autumnHandler } from "autumn-js/backend"; -import { WorkOSClient } from "../auth/workos"; -import { HttpResponseError, isServerError, toErrorServerResponse } from "./error-response"; +import { WorkOSClient } from "../../auth/workos"; +import { HttpResponseError, isServerError, toErrorServerResponse } from "../../api/error-response"; const handler = Effect.gen(function* () { const request = yield* HttpServerRequest.HttpServerRequest; @@ -58,7 +58,7 @@ const handler = Effect.gen(function* () { clientOptions: { secretKey: env.AUTUMN_SECRET_KEY ?? "", }, - pathPrefix: "/api/autumn", + pathPrefix: "/extensions/billing/route", }), ); @@ -81,4 +81,4 @@ const handler = Effect.gen(function* () { }), ); -export const AutumnRoutesLive = HttpRouter.add("*", "/api/autumn/*", handler); +export const AutumnRoutesLive = HttpRouter.add("*", "/extensions/billing/route/*", handler); diff --git a/apps/cloud/src/services/autumn.test-layer.ts b/apps/cloud/src/extensions/billing/service.test-layer.ts similarity index 94% rename from apps/cloud/src/services/autumn.test-layer.ts rename to apps/cloud/src/extensions/billing/service.test-layer.ts index b1c482d9e..4b1ca1dc5 100644 --- a/apps/cloud/src/services/autumn.test-layer.ts +++ b/apps/cloud/src/extensions/billing/service.test-layer.ts @@ -1,7 +1,7 @@ import { Effect, Layer } from "effect"; import type { Autumn } from "autumn-js"; -import { AutumnService, type IAutumnService } from "./autumn"; +import { AutumnService, type IAutumnService } from "./service"; export type AutumnTestSubscriptionSummary = { readonly planId?: string | null; diff --git a/apps/cloud/src/services/autumn.ts b/apps/cloud/src/extensions/billing/service.ts similarity index 100% rename from apps/cloud/src/services/autumn.ts rename to apps/cloud/src/extensions/billing/service.ts diff --git a/apps/cloud/src/api/docs.ts b/apps/cloud/src/extensions/docs.ts similarity index 93% rename from apps/cloud/src/api/docs.ts rename to apps/cloud/src/extensions/docs.ts index 4ab7b87bd..3500b5100 100644 --- a/apps/cloud/src/api/docs.ts +++ b/apps/cloud/src/extensions/docs.ts @@ -5,7 +5,7 @@ import { HttpApiSwagger, OpenApi } from "effect/unstable/httpapi"; import { CloudAuthApi, CloudAuthPublicApi } from "../auth/api"; import { OrgApi } from "../org/api"; -import { ProtectedCloudApi } from "./layers"; +import { ProtectedCloudApi } from "../api/layers"; export const CloudOpenApi = ProtectedCloudApi.add(CloudAuthPublicApi).add(CloudAuthApi).add(OrgApi); diff --git a/apps/cloud/src/api/extension-routes.ts b/apps/cloud/src/extensions/routes.ts similarity index 89% rename from apps/cloud/src/api/extension-routes.ts rename to apps/cloud/src/extensions/routes.ts index 1486a611e..8bb7b0979 100644 --- a/apps/cloud/src/api/extension-routes.ts +++ b/apps/cloud/src/extensions/routes.ts @@ -7,7 +7,7 @@ // switch-organization / invitations / MCP-approval) — `NonProtectedApi`. // - the cloud-only WorkOS domain-verification routes — `OrgHttpApi`. // - Swagger UI + the OpenAPI JSON for the full cloud spec. -// - the Autumn billing proxy (`/api/autumn/*`) — billing-as-extension. +// - the Autumn billing proxy (`/extensions/billing/route/*`) — billing-as-extension. // - the global request-failure logging middleware. // // They all serve UNDER the `/api` prefix (the same namespace the protected + @@ -35,11 +35,11 @@ import { CloudAuthApi, CloudAuthPublicApi } from "../auth/api"; import { OrgAuthLive, SessionAuthLive } from "../auth/middleware-live"; import { OrgApi, OrgHttpApi } from "../org/api"; import { OrgHandlers } from "../org/handlers"; -import { AutumnService } from "../services/autumn"; -import { DbService } from "../services/db"; -import { ProtectedCloudApi } from "./layers"; -import { AutumnRoutesLive } from "./autumn"; -import { ApiErrorLoggingLive } from "./error-logging"; +import { AutumnService } from "../extensions/billing/service"; +import { DbService } from "../db/db"; +import { ProtectedCloudApi } from "../api/layers"; +import { AutumnRoutesLive } from "./billing/route"; +import { ApiErrorLoggingLive } from "../observability/error-logging"; // The `/api`-prefixed `HttpRouter` view every cloud HttpApi group registers on, // so `/auth/me` serves at `/api/auth/me` (matching the protected + account @@ -87,10 +87,10 @@ export const makeCloudExtensionRoutes = (rsLive: Layer.Layer - unstable_dev(resolve(__dirname, "./test-worker.ts"), { + unstable_dev(resolve(__dirname, "./testing/test-worker.ts"), { config: resolve(__dirname, "../wrangler.miniflare.jsonc"), experimental: { disableExperimentalWarning: true }, ip: "127.0.0.1", diff --git a/apps/cloud/src/mcp-session.e2e.node.test.ts b/apps/cloud/src/mcp-session.e2e.node.test.ts index 781eb3f6c..83eff73b9 100644 --- a/apps/cloud/src/mcp-session.e2e.node.test.ts +++ b/apps/cloud/src/mcp-session.e2e.node.test.ts @@ -3,7 +3,7 @@ // The `McpSessionDO` in mcp-session.ts wires several things that previously // had zero integration coverage: // - `createScopedExecutor` against a real FumaDB/Drizzle handle (the 2026-04-16 -// prod outage was a schema spread bug here; see services/db.schema.test.ts) +// prod outage was a schema spread bug here; see db/db.schema.test.ts) // - `createExecutionEngine` with an in-process code executor // - `createExecutorMcpServer` for the MCP request surface // - Real `@modelcontextprotocol/sdk` Client → server round-trips @@ -36,8 +36,8 @@ import { import { FetchHttpClient } from "effect/unstable/http"; import { makeTestWorkOSVaultClient } from "@executor-js/plugin-workos-vault/testing"; import executorConfig from "../executor.config"; -import { DbService } from "./services/db"; -import { createDrizzleFumaDb } from "./services/fuma"; +import { DbService } from "./db/db"; +import { createDrizzleFumaDb } from "./db/fuma"; // --------------------------------------------------------------------------- // Test-only plugin: exposes one in-memory tool that elicits once. Lets the diff --git a/apps/cloud/src/mcp/auth.ts b/apps/cloud/src/mcp/auth.ts index c50d16191..c1cbe2127 100644 --- a/apps/cloud/src/mcp/auth.ts +++ b/apps/cloud/src/mcp/auth.ts @@ -12,13 +12,13 @@ import { env } from "cloudflare:workers"; import { Context, Effect, Layer, Predicate } from "effect"; -import { createCachedRemoteJWKSet } from "../jwks-cache"; +import { createCachedRemoteJWKSet } from "../auth/jwks-cache"; import { ApiKeyService } from "../auth/api-keys"; import { BEARER_PREFIX } from "../auth/bearer"; import { authorizeOrganization } from "../auth/organization"; import { UserStoreService } from "../auth/context"; import { CoreSharedServices } from "../api/core-shared-services"; -import { DbService } from "../services/db"; +import { DbService } from "../db/db"; import { bearerChallenge } from "./responses"; import { McpJwtVerificationError, verifyWorkOSMcpAccessToken, type VerifiedToken } from "./jwt"; diff --git a/apps/cloud/src/mcp-auth.node.test.ts b/apps/cloud/src/mcp/mcp-auth.node.test.ts similarity index 97% rename from apps/cloud/src/mcp-auth.node.test.ts rename to apps/cloud/src/mcp/mcp-auth.node.test.ts index 00df16c50..c902f1682 100644 --- a/apps/cloud/src/mcp-auth.node.test.ts +++ b/apps/cloud/src/mcp/mcp-auth.node.test.ts @@ -2,11 +2,7 @@ import { describe, expect, it } from "@effect/vitest"; import { Effect } from "effect"; import { SignJWT, createLocalJWKSet, exportJWK, generateKeyPair } from "jose"; -import { - McpJwtVerificationError, - verifyMcpAccessToken, - verifyWorkOSMcpAccessToken, -} from "./mcp/jwt"; +import { McpJwtVerificationError, verifyMcpAccessToken, verifyWorkOSMcpAccessToken } from "./jwt"; const issuer = "https://test-authkit.example.com"; const resource = "https://test-resource.example.com/mcp"; diff --git a/apps/cloud/src/services/mcp-oauth.node.test.ts b/apps/cloud/src/mcp/mcp-oauth.node.test.ts similarity index 99% rename from apps/cloud/src/services/mcp-oauth.node.test.ts rename to apps/cloud/src/mcp/mcp-oauth.node.test.ts index bc873c889..13662ebc2 100644 --- a/apps/cloud/src/services/mcp-oauth.node.test.ts +++ b/apps/cloud/src/mcp/mcp-oauth.node.test.ts @@ -28,7 +28,7 @@ import { Effect, Result } from "effect"; import { ScopeId } from "@executor-js/sdk"; import { serveOAuthTestServer, type OAuthTestServerShape } from "@executor-js/sdk/testing"; -import { asOrg, asUser, testUserOrgScopeId } from "./__test-harness__/api-harness"; +import { asOrg, asUser, testUserOrgScopeId } from "../testing/api-harness"; // --------------------------------------------------------------------------- // Helpers diff --git a/apps/cloud/src/mcp/session-durable-object.ts b/apps/cloud/src/mcp/session-durable-object.ts index e4d09e973..9ad45ff6a 100644 --- a/apps/cloud/src/mcp/session-durable-object.ts +++ b/apps/cloud/src/mcp/session-durable-object.ts @@ -20,7 +20,7 @@ import { type ExecutionEngine, type ResumeResponse, } from "@executor-js/execution"; -import type { DrizzleDb, DbServiceShape } from "../services/db"; +import type { DrizzleDb, DbServiceShape } from "../db/db"; // The DO only needs the neutral boot-scoped service (WorkOSClient). It never // bills, so it does NOT depend on any billing service — `CloudExecutionStackLayer` @@ -30,10 +30,10 @@ import type { DrizzleDb, DbServiceShape } from "../services/db"; import { CoreSharedServices } from "../api/core-shared-services"; import { UserStoreService } from "../auth/context"; import { resolveOrganization } from "../auth/organization"; -import { DbService, combinedSchema, resolveConnectionString } from "../services/db"; -import { CloudExecutionStackLayer, makeExecutionStack } from "../services/execution-stack"; -import { makeMcpWorkerTransport, type McpWorkerTransport } from "../services/mcp-worker-transport"; -import { DoTelemetryLive } from "../services/telemetry"; +import { DbService, combinedSchema, resolveConnectionString } from "../db/db"; +import { CloudExecutionStackLayer, makeExecutionStack } from "../engine/execution-stack"; +import { makeMcpWorkerTransport, type McpWorkerTransport } from "../mcp/worker-transport"; +import { DoTelemetryLive } from "../observability/telemetry"; import { captureCause } from "../observability"; import { INTERNAL_ACCOUNT_ID_HEADER, INTERNAL_ORGANIZATION_ID_HEADER } from "./do-headers"; diff --git a/apps/cloud/src/services/mcp-worker-transport.test.ts b/apps/cloud/src/mcp/worker-transport.test.ts similarity index 99% rename from apps/cloud/src/services/mcp-worker-transport.test.ts rename to apps/cloud/src/mcp/worker-transport.test.ts index 4a994172c..b4405d2ea 100644 --- a/apps/cloud/src/services/mcp-worker-transport.test.ts +++ b/apps/cloud/src/mcp/worker-transport.test.ts @@ -1,6 +1,6 @@ import { describe, expect, it } from "@effect/vitest"; -import { JsonRpcRequestIdQueue, PREVIOUS_REQUEST_TIMEOUT_MS } from "./mcp-worker-transport"; +import { JsonRpcRequestIdQueue, PREVIOUS_REQUEST_TIMEOUT_MS } from "./worker-transport"; const jsonRpcRequest = (body: unknown): Request => new Request("https://example.invalid/mcp", { diff --git a/apps/cloud/src/services/mcp-worker-transport.ts b/apps/cloud/src/mcp/worker-transport.ts similarity index 100% rename from apps/cloud/src/services/mcp-worker-transport.ts rename to apps/cloud/src/mcp/worker-transport.ts diff --git a/apps/cloud/src/api/error-logging.ts b/apps/cloud/src/observability/error-logging.ts similarity index 100% rename from apps/cloud/src/api/error-logging.ts rename to apps/cloud/src/observability/error-logging.ts diff --git a/apps/cloud/src/observability.ts b/apps/cloud/src/observability/index.ts similarity index 100% rename from apps/cloud/src/observability.ts rename to apps/cloud/src/observability/index.ts diff --git a/apps/cloud/src/observability.test.ts b/apps/cloud/src/observability/observability.test.ts similarity index 97% rename from apps/cloud/src/observability.test.ts rename to apps/cloud/src/observability/observability.test.ts index dffaab2a7..db3ecdefa 100644 --- a/apps/cloud/src/observability.test.ts +++ b/apps/cloud/src/observability/observability.test.ts @@ -1,7 +1,7 @@ import { describe, expect, it } from "@effect/vitest"; import { Cause } from "effect"; -import { sentryPayloadForCause } from "./observability"; +import { sentryPayloadForCause } from "./index"; // Mirrors Sentry core's `is.isError`: it picks the proper-Error path iff // `Object.prototype.toString.call(x) === "[object Error]"`. Anything that diff --git a/apps/cloud/src/services/telemetry.ts b/apps/cloud/src/observability/telemetry.ts similarity index 100% rename from apps/cloud/src/services/telemetry.ts rename to apps/cloud/src/observability/telemetry.ts diff --git a/apps/cloud/src/org/handlers.ts b/apps/cloud/src/org/handlers.ts index cd888c27d..a12811cec 100644 --- a/apps/cloud/src/org/handlers.ts +++ b/apps/cloud/src/org/handlers.ts @@ -4,7 +4,7 @@ import { Effect } from "effect"; import { AuthContext } from "@executor-js/api/server"; import { env } from "cloudflare:workers"; import { WorkOSClient } from "../auth/workos"; -import { AutumnService } from "../services/autumn"; +import { AutumnService } from "../extensions/billing/service"; import { Forbidden, OrgHttpApi } from "./api"; // --------------------------------------------------------------------------- diff --git a/apps/cloud/src/api/cloud-plugins.ts b/apps/cloud/src/plugins.ts similarity index 94% rename from apps/cloud/src/api/cloud-plugins.ts rename to apps/cloud/src/plugins.ts index 83e487490..f3852bdca 100644 --- a/apps/cloud/src/api/cloud-plugins.ts +++ b/apps/cloud/src/plugins.ts @@ -11,7 +11,7 @@ // `providePluginExtensions(cloudPlugins)`, `PluginExtensionServices` — from this one tuple, so adding/removing a plugin is // still a single `executor.config.ts` edit. -import executorConfig from "../../executor.config"; +import executorConfig from "../executor.config"; export const cloudPlugins = executorConfig.plugins(); export type CloudPlugins = typeof cloudPlugins; diff --git a/apps/cloud/src/routes/__root.tsx b/apps/cloud/src/routes/__root.tsx index 787206f06..5571fc49a 100644 --- a/apps/cloud/src/routes/__root.tsx +++ b/apps/cloud/src/routes/__root.tsx @@ -236,7 +236,7 @@ function AuthGate() { } return ( - + } showDialog={false}> } onHandledError={captureFrontendError}> diff --git a/apps/cloud/src/secrets-isolation.e2e.node.test.ts b/apps/cloud/src/secrets-isolation.e2e.node.test.ts index d862f3ace..fb0c54c8f 100644 --- a/apps/cloud/src/secrets-isolation.e2e.node.test.ts +++ b/apps/cloud/src/secrets-isolation.e2e.node.test.ts @@ -31,7 +31,7 @@ import { Effect, Result } from "effect"; import { ScopeId, SecretId } from "@executor-js/sdk"; -import { asUser, testUserOrgScopeId } from "./services/__test-harness__/api-harness"; +import { asUser, testUserOrgScopeId } from "./testing/api-harness"; const uniq = () => crypto.randomUUID().slice(0, 8); const nextOrgId = () => `org_iso_${uniq()}`; diff --git a/apps/cloud/src/server.ts b/apps/cloud/src/server.ts index 02484a356..e941de78d 100644 --- a/apps/cloud/src/server.ts +++ b/apps/cloud/src/server.ts @@ -10,7 +10,7 @@ import * as Sentry from "@sentry/cloudflare"; import handler from "@tanstack/react-start/server-entry"; import { McpSessionDO as McpSessionDOBase } from "./mcp/session-durable-object"; -import { flushTracerProvider, installTracerProvider } from "./services/telemetry"; +import { flushTracerProvider, installTracerProvider } from "./observability/telemetry"; // --------------------------------------------------------------------------- // Sentry config @@ -32,7 +32,7 @@ const sentryOptions = (env: Env) => ({ // --------------------------------------------------------------------------- // Durable Object — wrapped with Sentry so DO errors land in Sentry (inits the // client inside the DO isolate, which plain `Sentry.captureException` cannot -// do on its own). OTEL is installed through Effect layers (services/telemetry), +// do on its own). OTEL is installed through Effect layers (observability/telemetry), // not a global fetch wrapper. // --------------------------------------------------------------------------- @@ -45,7 +45,7 @@ export const McpSessionDO = Sentry.instrumentDurableObjectWithSentry( // Worker fetch handler // // We open a single `http.server ` span at the worker boundary using -// the same WebTracerProvider that `services/telemetry.ts` already installs for +// the same WebTracerProvider that `observability/telemetry.ts` already installs for // Effect-driven spans. This restores the per-request envelope span that was // previously emitted by `@microlabs/otel-cf-workers` and lost in the alchemy // migration — without the OTel-SDK version-conflict that package would now diff --git a/apps/cloud/src/services/executor-schema.ts b/apps/cloud/src/services/executor-schema.ts deleted file mode 100644 index e4c9eb815..000000000 --- a/apps/cloud/src/services/executor-schema.ts +++ /dev/null @@ -1,165 +0,0 @@ -import { pgTable, varchar, text, boolean, timestamp, uniqueIndex, json, bigint } from "drizzle-orm/pg-core" -import { createId } from "fumadb/cuid" - -export const source = pgTable("source", { - row_id: varchar("row_id", { length: 255 }).primaryKey().notNull().$defaultFn(() => createId()), - id: varchar("id", { length: 255 }).notNull(), - scope_id: varchar("scope_id", { length: 255 }).notNull(), - plugin_id: text("plugin_id").notNull(), - kind: text("kind").notNull(), - name: text("name").notNull(), - url: text("url"), - can_remove: boolean("can_remove").notNull().default(true), - can_refresh: boolean("can_refresh").notNull().default(false), - can_edit: boolean("can_edit").notNull().default(false), - created_at: timestamp("created_at").notNull(), - updated_at: timestamp("updated_at").notNull() -}, (table) => [ - uniqueIndex("source_scope_id_id_uidx").on(table.scope_id, table.id) -]) - -export const tool = pgTable("tool", { - row_id: varchar("row_id", { length: 255 }).primaryKey().notNull().$defaultFn(() => createId()), - id: varchar("id", { length: 255 }).notNull(), - scope_id: varchar("scope_id", { length: 255 }).notNull(), - source_id: text("source_id").notNull(), - plugin_id: text("plugin_id").notNull(), - name: text("name").notNull(), - description: text("description").notNull(), - input_schema: json("input_schema"), - output_schema: json("output_schema"), - created_at: timestamp("created_at").notNull(), - updated_at: timestamp("updated_at").notNull() -}, (table) => [ - uniqueIndex("tool_scope_id_id_uidx").on(table.scope_id, table.id) -]) - -export const definition = pgTable("definition", { - row_id: varchar("row_id", { length: 255 }).primaryKey().notNull().$defaultFn(() => createId()), - id: varchar("id", { length: 255 }).notNull(), - scope_id: varchar("scope_id", { length: 255 }).notNull(), - source_id: text("source_id").notNull(), - plugin_id: text("plugin_id").notNull(), - name: text("name").notNull(), - schema: json("schema").notNull(), - created_at: timestamp("created_at").notNull() -}, (table) => [ - uniqueIndex("definition_scope_id_id_uidx").on(table.scope_id, table.id) -]) - -export const secret = pgTable("secret", { - row_id: varchar("row_id", { length: 255 }).primaryKey().notNull().$defaultFn(() => createId()), - id: varchar("id", { length: 255 }).notNull(), - scope_id: varchar("scope_id", { length: 255 }).notNull(), - name: text("name").notNull(), - provider: text("provider").notNull(), - owned_by_connection_id: text("owned_by_connection_id"), - created_at: timestamp("created_at").notNull() -}, (table) => [ - uniqueIndex("secret_scope_id_id_uidx").on(table.scope_id, table.id) -]) - -export const connection = pgTable("connection", { - row_id: varchar("row_id", { length: 255 }).primaryKey().notNull().$defaultFn(() => createId()), - id: varchar("id", { length: 255 }).notNull(), - scope_id: varchar("scope_id", { length: 255 }).notNull(), - provider: text("provider").notNull(), - identity_label: text("identity_label"), - access_token_secret_id: text("access_token_secret_id").notNull(), - refresh_token_secret_id: text("refresh_token_secret_id"), - expires_at: bigint("expires_at", { mode: "bigint" }), - scope: text("scope"), - provider_state: json("provider_state"), - created_at: timestamp("created_at").notNull(), - updated_at: timestamp("updated_at").notNull() -}, (table) => [ - uniqueIndex("connection_scope_id_id_uidx").on(table.scope_id, table.id) -]) - -export const oauth2_session = pgTable("oauth2_session", { - row_id: varchar("row_id", { length: 255 }).primaryKey().notNull().$defaultFn(() => createId()), - id: varchar("id", { length: 255 }).notNull(), - scope_id: varchar("scope_id", { length: 255 }).notNull(), - plugin_id: text("plugin_id").notNull(), - strategy: text("strategy").notNull(), - connection_id: text("connection_id").notNull(), - token_scope: text("token_scope").notNull(), - redirect_url: text("redirect_url").notNull(), - payload: json("payload").notNull(), - expires_at: bigint("expires_at", { mode: "bigint" }).notNull(), - created_at: timestamp("created_at").notNull() -}, (table) => [ - uniqueIndex("oauth2_session_scope_id_id_uidx").on(table.scope_id, table.id) -]) - -export const credential_binding = pgTable("credential_binding", { - row_id: varchar("row_id", { length: 255 }).primaryKey().notNull().$defaultFn(() => createId()), - id: varchar("id", { length: 255 }).notNull(), - scope_id: varchar("scope_id", { length: 255 }).notNull(), - plugin_id: text("plugin_id").notNull(), - source_id: text("source_id").notNull(), - source_scope_id: text("source_scope_id").notNull(), - slot_key: text("slot_key").notNull(), - kind: text("kind").notNull(), - text_value: text("text_value"), - secret_id: text("secret_id"), - secret_scope_id: text("secret_scope_id"), - connection_id: text("connection_id"), - created_at: timestamp("created_at").notNull(), - updated_at: timestamp("updated_at").notNull() -}, (table) => [ - uniqueIndex("credential_binding_scope_id_id_uidx").on(table.scope_id, table.id) -]) - -export const plugin_storage = pgTable("plugin_storage", { - row_id: varchar("row_id", { length: 255 }).primaryKey().notNull().$defaultFn(() => createId()), - id: varchar("id", { length: 255 }).notNull(), - scope_id: varchar("scope_id", { length: 255 }).notNull(), - plugin_id: text("plugin_id").notNull(), - collection: text("collection").notNull(), - key: text("key").notNull(), - data: json("data").notNull(), - created_at: timestamp("created_at").notNull(), - updated_at: timestamp("updated_at").notNull() -}, (table) => [ - uniqueIndex("plugin_storage_scope_id_id_uidx").on(table.scope_id, table.id) -]) - -export const tool_policy = pgTable("tool_policy", { - row_id: varchar("row_id", { length: 255 }).primaryKey().notNull().$defaultFn(() => createId()), - id: varchar("id", { length: 255 }).notNull(), - scope_id: varchar("scope_id", { length: 255 }).notNull(), - pattern: text("pattern").notNull(), - action: text("action").notNull(), - position: text("position").notNull(), - created_at: timestamp("created_at").notNull(), - updated_at: timestamp("updated_at").notNull() -}, (table) => [ - uniqueIndex("tool_policy_scope_id_id_uidx").on(table.scope_id, table.id) -]) - -export const blob = pgTable("blob", { - row_id: varchar("row_id", { length: 255 }).primaryKey().notNull().$defaultFn(() => createId()), - id: varchar("id", { length: 255 }).notNull(), - namespace: text("namespace").notNull(), - key: text("key").notNull(), - value: text("value").notNull() -}, (table) => [ - uniqueIndex("blob_id_uidx").on(table.id) -]) - -export const workos_vault_metadata = pgTable("workos_vault_metadata", { - row_id: varchar("row_id", { length: 255 }).primaryKey().notNull().$defaultFn(() => createId()), - id: varchar("id", { length: 255 }).notNull(), - scope_id: varchar("scope_id", { length: 255 }).notNull(), - name: text("name").notNull(), - purpose: text("purpose"), - created_at: timestamp("created_at").notNull() -}, (table) => [ - uniqueIndex("workos_vault_metadata_scope_id_id_uidx").on(table.scope_id, table.id) -]) - -export const private_executor_cloud_settings = pgTable("private_executor_cloud_settings", { - id: varchar("id", { length: 255 }).primaryKey().notNull(), - version: varchar("version", { length: 255 }).notNull().default("1.0.0") -}) diff --git a/apps/cloud/src/services/__test-harness__/api-harness.ts b/apps/cloud/src/testing/api-harness.ts similarity index 98% rename from apps/cloud/src/services/__test-harness__/api-harness.ts rename to apps/cloud/src/testing/api-harness.ts index a007f5720..56b931338 100644 --- a/apps/cloud/src/services/__test-harness__/api-harness.ts +++ b/apps/cloud/src/testing/api-harness.ts @@ -30,12 +30,12 @@ import { makeQuickJsExecutor } from "@executor-js/runtime-quickjs"; import { createExecutor, makeUserOrgScopeStack, userOrgScopeId } from "@executor-js/sdk"; import { makeTestWorkOSVaultClient } from "@executor-js/plugin-workos-vault/testing"; -import executorConfig from "../../../executor.config"; +import executorConfig from "../../executor.config"; import { AuthContext, RouterConfigLive } from "@executor-js/api/server"; -import { ProtectedCloudApi, ProtectedCloudApiHandlers } from "../../api/layers"; -import { DbService } from "../db"; -import { createDrizzleFumaDb } from "../fuma"; +import { ProtectedCloudApi, ProtectedCloudApiHandlers } from "../api/layers"; +import { DbService } from "../db/db"; +import { createDrizzleFumaDb } from "../db/fuma"; export const TEST_BASE_URL = "http://test.local"; export const TEST_ORG_HEADER = "x-test-org-id"; diff --git a/apps/cloud/src/test-bearer.ts b/apps/cloud/src/testing/test-bearer.ts similarity index 95% rename from apps/cloud/src/test-bearer.ts rename to apps/cloud/src/testing/test-bearer.ts index 41440467b..d7dea789a 100644 --- a/apps/cloud/src/test-bearer.ts +++ b/apps/cloud/src/testing/test-bearer.ts @@ -3,7 +3,7 @@ // zero-dependency module so node tests can pull it without dragging in the // worker entry, which imports `cloudflare:workers`. -import type { VerifiedToken } from "./mcp/jwt"; +import type { VerifiedToken } from "../mcp/jwt"; export const TEST_BEARER_PREFIX = "test-accept::"; export const NO_ORG_SENTINEL = "none"; diff --git a/apps/cloud/src/test-worker.ts b/apps/cloud/src/testing/test-worker.ts similarity index 92% rename from apps/cloud/src/test-worker.ts rename to apps/cloud/src/testing/test-worker.ts index 9852fff29..0be9aa502 100644 --- a/apps/cloud/src/test-worker.ts +++ b/apps/cloud/src/testing/test-worker.ts @@ -25,16 +25,16 @@ import { McpOrganizationAuthLive, mcpAuthorized, mcpUnauthorized, -} from "./mcp/auth"; -import { classifyMcpPath, makeMcpWebHandler } from "./mcp/mount"; -import { cloudMcpAuthProviderLayer } from "./mcp/auth-provider"; -import { ApiKeyService } from "./auth/api-keys"; -import { organizations } from "./services/schema"; +} from "../mcp/auth"; +import { classifyMcpPath, makeMcpWebHandler } from "../mcp/mount"; +import { cloudMcpAuthProviderLayer } from "../mcp/auth-provider"; +import { ApiKeyService } from "../auth/api-keys"; +import { organizations } from "../db/schema"; import { parseTestBearer } from "./test-bearer"; -import { DoTelemetryLive } from "./services/telemetry"; -import { CoreSharedServices } from "./api/core-shared-services"; +import { DoTelemetryLive } from "../observability/telemetry"; +import { CoreSharedServices } from "../api/core-shared-services"; -export { McpSessionDO } from "./mcp/session-durable-object"; +export { McpSessionDO } from "../mcp/session-durable-object"; const TestMcpAuthLive = Layer.succeed(McpAuth)({ verifyBearer: (request) => diff --git a/apps/cloud/wrangler.miniflare.jsonc b/apps/cloud/wrangler.miniflare.jsonc index 2fdcf89e4..4507d7e49 100644 --- a/apps/cloud/wrangler.miniflare.jsonc +++ b/apps/cloud/wrangler.miniflare.jsonc @@ -7,7 +7,7 @@ "name": "executor-cloud-miniflare", "compatibility_date": "2025-06-01", "compatibility_flags": ["nodejs_compat"], - "main": "src/test-worker.ts", + "main": "src/testing/test-worker.ts", "vars": { "DATABASE_URL": "postgresql://postgres:postgres@127.0.0.1:5434/postgres", "EXECUTOR_DIRECT_DATABASE_URL": "true", diff --git a/apps/cloud/wrangler.test.jsonc b/apps/cloud/wrangler.test.jsonc index 134451f03..0c99b1f08 100644 --- a/apps/cloud/wrangler.test.jsonc +++ b/apps/cloud/wrangler.test.jsonc @@ -3,7 +3,7 @@ "name": "executor-cloud-test", "compatibility_date": "2025-06-01", "compatibility_flags": ["nodejs_compat"], - "main": "src/test-worker.ts", + "main": "src/testing/test-worker.ts", "vars": { "DATABASE_URL": "postgresql://postgres:postgres@127.0.0.1:5434/postgres", "EXECUTOR_DIRECT_DATABASE_URL": "true", diff --git a/apps/local/src/server/app.ts b/apps/local/src/app.ts similarity index 100% rename from apps/local/src/server/app.ts rename to apps/local/src/app.ts diff --git a/apps/local/src/server/auth-tool-failures.test.ts b/apps/local/src/auth-tool-failures.test.ts similarity index 99% rename from apps/local/src/server/auth-tool-failures.test.ts rename to apps/local/src/auth-tool-failures.test.ts index 68b42b8fb..a9c09d294 100644 --- a/apps/local/src/server/auth-tool-failures.test.ts +++ b/apps/local/src/auth-tool-failures.test.ts @@ -48,7 +48,7 @@ import { makeQuickJsExecutor } from "@executor-js/runtime-quickjs"; import { Scope, ScopeId, createExecutor } from "@executor-js/sdk"; import { ErrorCaptureLive } from "./observability"; -import { createSqliteFumaDb } from "./sqlite-fumadb"; +import { createSqliteFumaDb } from "./db/sqlite-fumadb"; const TEST_BASE_URL = "http://local.test"; diff --git a/apps/local/src/server/db-upgrade.test.ts b/apps/local/src/db/db-upgrade.test.ts similarity index 99% rename from apps/local/src/server/db-upgrade.test.ts rename to apps/local/src/db/db-upgrade.test.ts index af49e7038..8eb4c5b2b 100644 --- a/apps/local/src/server/db-upgrade.test.ts +++ b/apps/local/src/db/db-upgrade.test.ts @@ -9,7 +9,7 @@ import { existsSync, mkdtempSync, rmSync, writeFileSync } from "node:fs"; import { tmpdir } from "node:os"; import { join } from "node:path"; -import { openTestDb, runMigrations } from "./__test-helpers__/libsql-test-db"; +import { openTestDb, runMigrations } from "../testing/libsql-test-db"; import { importLegacySecrets, isPreScopeSchema, diff --git a/apps/local/src/server/db-upgrade.ts b/apps/local/src/db/db-upgrade.ts similarity index 100% rename from apps/local/src/server/db-upgrade.ts rename to apps/local/src/db/db-upgrade.ts diff --git a/apps/local/src/server/embedded-migrations.gen.ts b/apps/local/src/db/embedded-migrations.gen.ts similarity index 100% rename from apps/local/src/server/embedded-migrations.gen.ts rename to apps/local/src/db/embedded-migrations.gen.ts diff --git a/apps/local/src/server/executor-schema.ts b/apps/local/src/db/executor-schema.ts similarity index 100% rename from apps/local/src/server/executor-schema.ts rename to apps/local/src/db/executor-schema.ts diff --git a/apps/local/src/server/google-discovery-openapi-migration.test.ts b/apps/local/src/db/google-discovery-openapi-migration.test.ts similarity index 100% rename from apps/local/src/server/google-discovery-openapi-migration.test.ts rename to apps/local/src/db/google-discovery-openapi-migration.test.ts diff --git a/apps/local/src/server/google-discovery-openapi-migration.ts b/apps/local/src/db/google-discovery-openapi-migration.ts similarity index 100% rename from apps/local/src/server/google-discovery-openapi-migration.ts rename to apps/local/src/db/google-discovery-openapi-migration.ts diff --git a/apps/local/src/server/libsql.ts b/apps/local/src/db/libsql.ts similarity index 100% rename from apps/local/src/server/libsql.ts rename to apps/local/src/db/libsql.ts diff --git a/apps/local/src/server/migrate-google-discovery-bindings.test.ts b/apps/local/src/db/migrate-google-discovery-bindings.test.ts similarity index 97% rename from apps/local/src/server/migrate-google-discovery-bindings.test.ts rename to apps/local/src/db/migrate-google-discovery-bindings.test.ts index bc51b768f..d7ff10b13 100644 --- a/apps/local/src/server/migrate-google-discovery-bindings.test.ts +++ b/apps/local/src/db/migrate-google-discovery-bindings.test.ts @@ -10,8 +10,8 @@ import { mkdtempSync, rmSync } from "node:fs"; import { join } from "node:path"; import { tmpdir } from "node:os"; -import { openTestDb, runMigrations } from "./__test-helpers__/libsql-test-db"; -import { PRE_0007_SQL, stampPriorMigrationsApplied } from "./__test-helpers__/pre-0007-schema"; +import { openTestDb, runMigrations } from "../testing/libsql-test-db"; +import { PRE_0007_SQL, stampPriorMigrationsApplied } from "../testing/pre-0007-schema"; const MIGRATIONS_FOLDER = join(import.meta.dirname, "../../drizzle"); diff --git a/apps/local/src/server/migrate-graphql-bindings.test.ts b/apps/local/src/db/migrate-graphql-bindings.test.ts similarity index 98% rename from apps/local/src/server/migrate-graphql-bindings.test.ts rename to apps/local/src/db/migrate-graphql-bindings.test.ts index 1f79485d4..c3f7d563b 100644 --- a/apps/local/src/server/migrate-graphql-bindings.test.ts +++ b/apps/local/src/db/migrate-graphql-bindings.test.ts @@ -9,8 +9,8 @@ import { mkdtempSync, rmSync } from "node:fs"; import { join } from "node:path"; import { tmpdir } from "node:os"; -import { openTestDb, runMigrations } from "./__test-helpers__/libsql-test-db"; -import { PRE_0007_SQL, stampPriorMigrationsApplied } from "./__test-helpers__/pre-0007-schema"; +import { openTestDb, runMigrations } from "../testing/libsql-test-db"; +import { PRE_0007_SQL, stampPriorMigrationsApplied } from "../testing/pre-0007-schema"; const MIGRATIONS_FOLDER = join(import.meta.dirname, "../../drizzle"); diff --git a/apps/local/src/server/migrate-mcp-bindings.test.ts b/apps/local/src/db/migrate-mcp-bindings.test.ts similarity index 97% rename from apps/local/src/server/migrate-mcp-bindings.test.ts rename to apps/local/src/db/migrate-mcp-bindings.test.ts index 596dad15b..b73c63020 100644 --- a/apps/local/src/server/migrate-mcp-bindings.test.ts +++ b/apps/local/src/db/migrate-mcp-bindings.test.ts @@ -9,8 +9,8 @@ import { join } from "node:path"; import { tmpdir } from "node:os"; import { Schema } from "effect"; -import { openTestDb, runMigrations } from "./__test-helpers__/libsql-test-db"; -import { PRE_0007_SQL, stampPriorMigrationsApplied } from "./__test-helpers__/pre-0007-schema"; +import { openTestDb, runMigrations } from "../testing/libsql-test-db"; +import { PRE_0007_SQL, stampPriorMigrationsApplied } from "../testing/pre-0007-schema"; const MIGRATIONS_FOLDER = join(import.meta.dirname, "../../drizzle"); diff --git a/apps/local/src/server/migrate-oauth-connections.test.ts b/apps/local/src/db/migrate-oauth-connections.test.ts similarity index 99% rename from apps/local/src/server/migrate-oauth-connections.test.ts rename to apps/local/src/db/migrate-oauth-connections.test.ts index 680a371b8..b0b4f8af4 100644 --- a/apps/local/src/server/migrate-oauth-connections.test.ts +++ b/apps/local/src/db/migrate-oauth-connections.test.ts @@ -1,5 +1,5 @@ import { afterEach, beforeEach, describe, expect, it } from "@effect/vitest"; -import { openTestDb, type LibsqlTestDb } from "./__test-helpers__/libsql-test-db"; +import { openTestDb, type LibsqlTestDb } from "../testing/libsql-test-db"; import { mkdtempSync, readFileSync, rmSync } from "node:fs"; import { tmpdir } from "node:os"; import { join } from "node:path"; diff --git a/apps/local/src/server/migrate-openapi-bindings.test.ts b/apps/local/src/db/migrate-openapi-bindings.test.ts similarity index 98% rename from apps/local/src/server/migrate-openapi-bindings.test.ts rename to apps/local/src/db/migrate-openapi-bindings.test.ts index bdf7f6171..010c91501 100644 --- a/apps/local/src/server/migrate-openapi-bindings.test.ts +++ b/apps/local/src/db/migrate-openapi-bindings.test.ts @@ -11,8 +11,8 @@ import { join } from "node:path"; import { tmpdir } from "node:os"; import { Schema } from "effect"; -import { LibsqlTestDb, openTestDb, runMigrations } from "./__test-helpers__/libsql-test-db"; -import { PRE_0007_SQL, stampPriorMigrationsApplied } from "./__test-helpers__/pre-0007-schema"; +import { LibsqlTestDb, openTestDb, runMigrations } from "../testing/libsql-test-db"; +import { PRE_0007_SQL, stampPriorMigrationsApplied } from "../testing/pre-0007-schema"; const MIGRATIONS_FOLDER = join(import.meta.dirname, "../../drizzle"); diff --git a/apps/local/src/server/migration-nesting.test.ts b/apps/local/src/db/migration-nesting.test.ts similarity index 100% rename from apps/local/src/server/migration-nesting.test.ts rename to apps/local/src/db/migration-nesting.test.ts diff --git a/apps/local/src/server/sqlite-fumadb.ts b/apps/local/src/db/sqlite-fumadb.ts similarity index 100% rename from apps/local/src/server/sqlite-fumadb.ts rename to apps/local/src/db/sqlite-fumadb.ts diff --git a/apps/local/src/server/sqlite-import.test.ts b/apps/local/src/db/sqlite-import.test.ts similarity index 99% rename from apps/local/src/server/sqlite-import.test.ts rename to apps/local/src/db/sqlite-import.test.ts index 67fdcaa07..a202a81f2 100644 --- a/apps/local/src/server/sqlite-import.test.ts +++ b/apps/local/src/db/sqlite-import.test.ts @@ -18,8 +18,8 @@ import { } from "@executor-js/sdk"; import { withQueryContext } from "fumadb/query"; -import { openTestClient, openTestDb } from "./__test-helpers__/libsql-test-db"; -import { importLegacySqliteIfNeeded, readBundledDrizzleMigrationHashes } from "./executor"; +import { openTestClient, openTestDb } from "../testing/libsql-test-db"; +import { importLegacySqliteIfNeeded, readBundledDrizzleMigrationHashes } from "../executor"; import { importSqliteDataToFuma, readLegacySqliteScopeIds } from "./sqlite-import"; import { createSqliteFumaDb, type SqliteFumaDb } from "./sqlite-fumadb"; diff --git a/apps/local/src/server/sqlite-import.ts b/apps/local/src/db/sqlite-import.ts similarity index 100% rename from apps/local/src/server/sqlite-import.ts rename to apps/local/src/db/sqlite-import.ts diff --git a/apps/local/src/server/executor.ts b/apps/local/src/executor.ts similarity index 98% rename from apps/local/src/server/executor.ts rename to apps/local/src/executor.ts index 76e9fdd86..3e98833a6 100644 --- a/apps/local/src/server/executor.ts +++ b/apps/local/src/executor.ts @@ -19,23 +19,23 @@ import { collectTables } from "@executor-js/api/server"; import { withQueryContext } from "fumadb/query"; import { loadPluginsFromJsonc } from "@executor-js/config"; -import executorConfig from "../../executor.config"; -import embeddedMigrations from "./embedded-migrations.gen"; +import executorConfig from "../executor.config"; +import embeddedMigrations from "./db/embedded-migrations.gen"; import { importLegacySecrets, moveAsidePreScopeDb, readLegacySecrets, type LegacySecret, -} from "./db-upgrade"; -import * as legacyExecutorSchema from "./executor-schema"; +} from "./db/db-upgrade"; +import * as legacyExecutorSchema from "./db/executor-schema"; import { importSqliteDataToFuma, readLegacySqliteScopeIds, type LocalSqliteImportResult, -} from "./sqlite-import"; -import { createSqliteFumaDb } from "./sqlite-fumadb"; -import { openLegacyLibsql, queryFirst, queryRows } from "./libsql"; -import { oneShotMigrateGoogleDiscoveryToOpenApi } from "./google-discovery-openapi-migration"; +} from "./db/sqlite-import"; +import { createSqliteFumaDb } from "./db/sqlite-fumadb"; +import { openLegacyLibsql, queryFirst, queryRows } from "./db/libsql"; +import { oneShotMigrateGoogleDiscoveryToOpenApi } from "./db/google-discovery-openapi-migration"; interface ResolvedStorage { readonly dataDir: string; diff --git a/apps/local/src/server/identity.ts b/apps/local/src/identity.ts similarity index 100% rename from apps/local/src/server/identity.ts rename to apps/local/src/identity.ts diff --git a/apps/local/src/index.ts b/apps/local/src/index.ts index 14aca791e..1f759296f 100644 --- a/apps/local/src/index.ts +++ b/apps/local/src/index.ts @@ -3,7 +3,7 @@ export { getServerHandlers, disposeServerHandlers, type ServerHandlers, -} from "./server/main"; +} from "./main"; export { createExecutorHandle, disposeExecutor, @@ -11,6 +11,6 @@ export { reloadExecutor, type ExecutorHandle, type LocalExecutor, -} from "./server/executor"; -export { createMcpRequestHandler, runMcpStdioServer, type McpRequestHandler } from "./server/mcp"; +} from "./executor"; +export { createMcpRequestHandler, runMcpStdioServer, type McpRequestHandler } from "./mcp"; export { startServer, type StartServerOptions, type ServerInstance } from "./serve"; diff --git a/apps/local/src/server/installation.ts b/apps/local/src/installation.ts similarity index 95% rename from apps/local/src/server/installation.ts rename to apps/local/src/installation.ts index cd30c879d..90f7ea50c 100644 --- a/apps/local/src/server/installation.ts +++ b/apps/local/src/installation.ts @@ -4,7 +4,7 @@ import { type SurfaceClient, } from "@executor-js/integrations-registry"; -const pkg = await import("../../package.json"); +const pkg = await import("../package.json"); const LOCAL_VERSION: string = pkg.version; // A `-` in semver indicates a prerelease (beta train). diff --git a/apps/local/src/server/integrations.ts b/apps/local/src/integrations.ts similarity index 100% rename from apps/local/src/server/integrations.ts rename to apps/local/src/integrations.ts diff --git a/apps/local/src/server/main.ts b/apps/local/src/main.ts similarity index 100% rename from apps/local/src/server/main.ts rename to apps/local/src/main.ts diff --git a/apps/local/src/server/mcp-browser-resume.test.ts b/apps/local/src/mcp-browser-resume.test.ts similarity index 99% rename from apps/local/src/server/mcp-browser-resume.test.ts rename to apps/local/src/mcp-browser-resume.test.ts index 6bb1e536b..8b092cfa4 100644 --- a/apps/local/src/server/mcp-browser-resume.test.ts +++ b/apps/local/src/mcp-browser-resume.test.ts @@ -33,7 +33,7 @@ import { } from "@executor-js/sdk"; import { createMcpRequestHandler } from "./mcp"; -import { createSqliteFumaDb } from "./sqlite-fumadb"; +import { createSqliteFumaDb } from "./db/sqlite-fumadb"; const TEST_BASE_URL = "http://local.test"; diff --git a/apps/local/src/server/mcp-oauth.test.ts b/apps/local/src/mcp-oauth.test.ts similarity index 99% rename from apps/local/src/server/mcp-oauth.test.ts rename to apps/local/src/mcp-oauth.test.ts index 7f03de4c7..ec095b1cd 100644 --- a/apps/local/src/server/mcp-oauth.test.ts +++ b/apps/local/src/mcp-oauth.test.ts @@ -44,7 +44,7 @@ import { mcpPlugin } from "@executor-js/plugin-mcp"; import { McpExtensionService, McpGroup, McpHandlers } from "@executor-js/plugin-mcp/api"; import { ErrorCaptureLive } from "./observability"; -import { createSqliteFumaDb } from "./sqlite-fumadb"; +import { createSqliteFumaDb } from "./db/sqlite-fumadb"; // Shape of the test API: core + mcp group, with InternalError surfaced at // the top level so `observabilityMiddleware` can land its typed-error diff --git a/apps/local/src/server/mcp.ts b/apps/local/src/mcp.ts similarity index 100% rename from apps/local/src/server/mcp.ts rename to apps/local/src/mcp.ts diff --git a/apps/local/src/server/observability.ts b/apps/local/src/observability.ts similarity index 100% rename from apps/local/src/server/observability.ts rename to apps/local/src/observability.ts diff --git a/apps/local/src/serve.ts b/apps/local/src/serve.ts index 28c576e81..cc6ef3b9c 100644 --- a/apps/local/src/serve.ts +++ b/apps/local/src/serve.ts @@ -12,8 +12,8 @@ import { readdirSync } from "node:fs"; import type { Subprocess } from "bun"; import { setOAuthCompletionListener } from "@executor-js/api"; import { consumeOAuthResult, publishOAuthResult } from "./oauth-result-store"; -import { startIntegrationsRefresh } from "./server/integrations"; -import { getServerHandlers } from "./server/main"; +import { startIntegrationsRefresh } from "./integrations"; +import { getServerHandlers } from "./main"; import { DEFAULT_ALLOWED_HOSTS, hasFileExtension, diff --git a/apps/local/src/server/__test-helpers__/libsql-test-db.ts b/apps/local/src/testing/libsql-test-db.ts similarity index 100% rename from apps/local/src/server/__test-helpers__/libsql-test-db.ts rename to apps/local/src/testing/libsql-test-db.ts diff --git a/apps/local/src/server/__test-helpers__/pre-0007-schema.ts b/apps/local/src/testing/pre-0007-schema.ts similarity index 100% rename from apps/local/src/server/__test-helpers__/pre-0007-schema.ts rename to apps/local/src/testing/pre-0007-schema.ts diff --git a/apps/local/vite.config.ts b/apps/local/vite.config.ts index 3b42a7bd2..aab4f7d23 100644 --- a/apps/local/vite.config.ts +++ b/apps/local/vite.config.ts @@ -35,13 +35,13 @@ const APP_ROOT = fileURLToPath(new URL("../../packages/app/", import.meta.url)); * during development, so you don't need a separate server process. */ function executorApiPlugin(): Plugin { - let handlers: import("./src/server/main").ServerHandlers | null = null; + let handlers: import("./src/main").ServerHandlers | null = null; return { name: "executor-api", configureServer(server) { server.watcher.on("change", (path) => { - if (path.includes("/src/server/") || path.endsWith("/executor.config.ts")) { + if (path.includes("/apps/local/src/") || path.endsWith("/executor.config.ts")) { handlers = null; } }); @@ -55,7 +55,7 @@ function executorApiPlugin(): Plugin { // oxlint-disable-next-line executor/no-try-catch-or-throw -- boundary: Vite middleware must convert handler failures into HTTP 500 responses try { if (!handlers) { - const { getServerHandlers } = await import("./src/server/main"); + const { getServerHandlers } = await import("./src/main"); handlers = await getServerHandlers(); } diff --git a/scripts/oxlint-plugin-executor/rules/no-direct-cloud-executor-schema-import.js b/scripts/oxlint-plugin-executor/rules/no-direct-cloud-executor-schema-import.js index 06731100d..75ca1db1e 100644 --- a/scripts/oxlint-plugin-executor/rules/no-direct-cloud-executor-schema-import.js +++ b/scripts/oxlint-plugin-executor/rules/no-direct-cloud-executor-schema-import.js @@ -3,20 +3,15 @@ import { getPropertyName, isIdentifier, toRepoRelative, unwrapExpression } from const message = "Do not access cloud executor tables directly outside DB schema wiring. Executor-domain table access must go through the scoped SDK adapter so scope_id filtering cannot be skipped."; -const allowedFiles = new Set([ - "apps/cloud/src/services/db.ts", - "apps/cloud/src/services/db.schema.test.ts", -]); +const allowedFiles = new Set(["apps/cloud/src/db/db.ts", "apps/cloud/src/db/db.schema.test.ts"]); const isCloudSource = (filename) => toRepoRelative(filename).startsWith("apps/cloud/src/"); const isDirectExecutorSchemaImport = (specifier) => specifier === "./executor-schema" || specifier === "./executor-schema.ts" || - specifier === "../services/executor-schema" || - specifier === "../services/executor-schema.ts" || - specifier.endsWith("/services/executor-schema") || - specifier.endsWith("/services/executor-schema.ts"); + specifier.endsWith("/db/executor-schema") || + specifier.endsWith("/db/executor-schema.ts"); const coreTableNames = new Set([ "source", From 7d5d5944048bf1364a2244518eb45fd7d7437186 Mon Sep 17 00:00:00 2001 From: Rhys Sullivan Date: Sun, 31 May 2026 02:23:58 -0700 Subject: [PATCH 03/31] Add Cloudflare host + D1 hardening; share MCP session store MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Checkpoint of the provider-unification work. apps/host-cloudflare (new): Executor as one Cloudflare Worker — the 4th app on ExecutorApp.make. Cloudflare Access identity (+ Managed OAuth for MCP), D1 store, in-Worker QuickJS, the shared multiplayer SPA via Workers Static Assets, a minimal account provider, the MCP serving envelope, an idempotent deploy script, and an R2 large-value offload for the D1 handle. D1 compatibility: - fumadb drizzle adapter gains an interactiveTransactions flag (default true); D1 opts out (it rejects BEGIN/COMMIT) and runs transaction callbacks directly. libSQL/Postgres unchanged. - createExecutorFumaDb threads the flag through. - host-cloudflare wraps the D1 binding to offload oversized values (>~800KB) to R2 with a pointer in the row, rehydrating on read (D1 caps a value at ~1-2MB). Shared MCP: extract the in-process session store to @executor-js/host-mcp/in-memory-session-store; self-host and Cloudflare both consume it (only the per-session buildServer differs). self-host: single-tenant invite auth, zero-config first run, admin + system endpoints, docker-compose + docs. openapi: TODO documenting the proper blob-seam fix for large specs. local: correct the drizzle migrations path. --- apps/host-cloudflare/.gitignore | 3 + apps/host-cloudflare/CHANGELOG.md | 6 + apps/host-cloudflare/README.md | 89 +++++++ apps/host-cloudflare/executor.config.ts | 24 ++ apps/host-cloudflare/package.json | 52 ++++ apps/host-cloudflare/scripts/deploy.sh | 88 ++++++ .../scripts/vendor-quickjs-wasm.ts | 18 ++ .../src/account/account-provider.ts | 74 ++++++ apps/host-cloudflare/src/app.ts | 72 +++++ .../src/auth/cloudflare-access.ts | 93 +++++++ apps/host-cloudflare/src/config.ts | 86 ++++++ apps/host-cloudflare/src/db/d1.ts | 71 +++++ .../host-cloudflare/src/db/r2-blob-offload.ts | Bin 0 -> 9133 bytes apps/host-cloudflare/src/execution.ts | 69 +++++ apps/host-cloudflare/src/mcp/auth.ts | 35 +++ apps/host-cloudflare/src/mcp/index.ts | 63 +++++ apps/host-cloudflare/src/mcp/session-store.ts | 75 ++++++ apps/host-cloudflare/src/observability.ts | 7 + apps/host-cloudflare/src/plugins.ts | 25 ++ apps/host-cloudflare/src/quickjs-engine.wasm | Bin 0 -> 518880 bytes apps/host-cloudflare/src/quickjs.ts | 35 +++ apps/host-cloudflare/src/wasm.d.ts | 6 + apps/host-cloudflare/src/worker.ts | 26 ++ apps/host-cloudflare/tsconfig.json | 25 ++ apps/host-cloudflare/vite.config.ts | 57 ++++ apps/host-cloudflare/web/entry-client.tsx | 16 ++ apps/host-cloudflare/web/index.html | 22 ++ apps/host-cloudflare/web/routeTree.gen.ts | 231 ++++++++++++++++ apps/host-cloudflare/web/router.tsx | 10 + apps/host-cloudflare/web/routes/__root.tsx | 72 +++++ .../web/routes/connections.tsx | 6 + apps/host-cloudflare/web/routes/index.tsx | 6 + .../web/routes/plugins.$pluginId.$.tsx | 43 +++ apps/host-cloudflare/web/routes/policies.tsx | 6 + .../web/routes/resume.$executionId.tsx | 117 ++++++++ apps/host-cloudflare/web/routes/secrets.tsx | 25 ++ .../web/routes/sources.$namespace.tsx | 9 + .../web/routes/sources.add.$pluginKey.tsx | 19 ++ apps/host-cloudflare/web/routes/tools.tsx | 6 + apps/host-cloudflare/wrangler.jsonc | 52 ++++ apps/host-selfhost/.env.example | 32 +++ apps/host-selfhost/Dockerfile | 5 +- apps/host-selfhost/README.md | 47 ++++ apps/host-selfhost/docker-compose.yml | 42 +++ apps/host-selfhost/src/admin/api.ts | 92 +++++++ apps/host-selfhost/src/admin/handlers.ts | 139 ++++++++++ .../src/admin/invites.node.test.ts | 75 ++++++ apps/host-selfhost/src/app.ts | 6 + .../src/auth/better-auth.test.ts | 4 + apps/host-selfhost/src/auth/better-auth.ts | 136 ++++++++-- apps/host-selfhost/src/auth/invites.ts | 153 +++++++++++ apps/host-selfhost/src/auth/seed.ts | 76 +++--- apps/host-selfhost/src/config.ts | 39 ++- apps/host-selfhost/src/first-run.node.test.ts | 75 ++++++ apps/host-selfhost/src/mcp/mcp-oauth.test.ts | 5 +- apps/host-selfhost/src/mcp/mcp.test.ts | 5 +- apps/host-selfhost/src/mcp/session-store.ts | 205 ++------------ apps/host-selfhost/src/multi-user.test.ts | 5 +- apps/host-selfhost/src/sources-mcp.test.ts | 9 +- apps/host-selfhost/src/system/api.ts | 38 +++ apps/host-selfhost/src/system/handlers.ts | 66 +++++ apps/host-selfhost/src/testing/mint-invite.ts | 56 ++++ apps/host-selfhost/web/admin-atoms.tsx | 22 ++ apps/host-selfhost/web/admin-client.tsx | 35 +++ apps/host-selfhost/web/login.tsx | 157 ++++++----- apps/host-selfhost/web/routeTree.gen.ts | 42 +++ apps/host-selfhost/web/routes/__root.tsx | 57 +++- apps/host-selfhost/web/routes/admin.tsx | 251 ++++++++++++++++++ apps/host-selfhost/web/routes/join.$code.tsx | 104 ++++++++ apps/host-selfhost/web/setup-status.ts | 17 ++ apps/host-selfhost/web/setup.tsx | 92 +++++++ apps/local/src/executor.ts | 2 +- bun.lock | 102 ++++++- docs/docs.json | 9 + docs/self-hosting/guide.mdx | 117 ++++++++ .../core/fumadb/src/adapters/drizzle/index.ts | 11 +- .../core/fumadb/src/adapters/drizzle/query.ts | 18 +- packages/core/sdk/src/executor-fuma-db.ts | 9 + packages/hosts/mcp/package.json | 4 + .../hosts/mcp/src/in-memory-session-store.ts | 187 +++++++++++++ packages/plugins/openapi/src/sdk/plugin.ts | 10 + packages/react/src/components/sonner.tsx | 4 +- 82 files changed, 3967 insertions(+), 332 deletions(-) create mode 100644 apps/host-cloudflare/.gitignore create mode 100644 apps/host-cloudflare/CHANGELOG.md create mode 100644 apps/host-cloudflare/README.md create mode 100644 apps/host-cloudflare/executor.config.ts create mode 100644 apps/host-cloudflare/package.json create mode 100755 apps/host-cloudflare/scripts/deploy.sh create mode 100755 apps/host-cloudflare/scripts/vendor-quickjs-wasm.ts create mode 100644 apps/host-cloudflare/src/account/account-provider.ts create mode 100644 apps/host-cloudflare/src/app.ts create mode 100644 apps/host-cloudflare/src/auth/cloudflare-access.ts create mode 100644 apps/host-cloudflare/src/config.ts create mode 100644 apps/host-cloudflare/src/db/d1.ts create mode 100644 apps/host-cloudflare/src/db/r2-blob-offload.ts create mode 100644 apps/host-cloudflare/src/execution.ts create mode 100644 apps/host-cloudflare/src/mcp/auth.ts create mode 100644 apps/host-cloudflare/src/mcp/index.ts create mode 100644 apps/host-cloudflare/src/mcp/session-store.ts create mode 100644 apps/host-cloudflare/src/observability.ts create mode 100644 apps/host-cloudflare/src/plugins.ts create mode 100644 apps/host-cloudflare/src/quickjs-engine.wasm create mode 100644 apps/host-cloudflare/src/quickjs.ts create mode 100644 apps/host-cloudflare/src/wasm.d.ts create mode 100644 apps/host-cloudflare/src/worker.ts create mode 100644 apps/host-cloudflare/tsconfig.json create mode 100644 apps/host-cloudflare/vite.config.ts create mode 100644 apps/host-cloudflare/web/entry-client.tsx create mode 100644 apps/host-cloudflare/web/index.html create mode 100644 apps/host-cloudflare/web/routeTree.gen.ts create mode 100644 apps/host-cloudflare/web/router.tsx create mode 100644 apps/host-cloudflare/web/routes/__root.tsx create mode 100644 apps/host-cloudflare/web/routes/connections.tsx create mode 100644 apps/host-cloudflare/web/routes/index.tsx create mode 100644 apps/host-cloudflare/web/routes/plugins.$pluginId.$.tsx create mode 100644 apps/host-cloudflare/web/routes/policies.tsx create mode 100644 apps/host-cloudflare/web/routes/resume.$executionId.tsx create mode 100644 apps/host-cloudflare/web/routes/secrets.tsx create mode 100644 apps/host-cloudflare/web/routes/sources.$namespace.tsx create mode 100644 apps/host-cloudflare/web/routes/sources.add.$pluginKey.tsx create mode 100644 apps/host-cloudflare/web/routes/tools.tsx create mode 100644 apps/host-cloudflare/wrangler.jsonc create mode 100644 apps/host-selfhost/.env.example create mode 100644 apps/host-selfhost/README.md create mode 100644 apps/host-selfhost/docker-compose.yml create mode 100644 apps/host-selfhost/src/admin/api.ts create mode 100644 apps/host-selfhost/src/admin/handlers.ts create mode 100644 apps/host-selfhost/src/admin/invites.node.test.ts create mode 100644 apps/host-selfhost/src/auth/invites.ts create mode 100644 apps/host-selfhost/src/first-run.node.test.ts create mode 100644 apps/host-selfhost/src/system/api.ts create mode 100644 apps/host-selfhost/src/system/handlers.ts create mode 100644 apps/host-selfhost/src/testing/mint-invite.ts create mode 100644 apps/host-selfhost/web/admin-atoms.tsx create mode 100644 apps/host-selfhost/web/admin-client.tsx create mode 100644 apps/host-selfhost/web/routes/admin.tsx create mode 100644 apps/host-selfhost/web/routes/join.$code.tsx create mode 100644 apps/host-selfhost/web/setup-status.ts create mode 100644 apps/host-selfhost/web/setup.tsx create mode 100644 docs/self-hosting/guide.mdx create mode 100644 packages/hosts/mcp/src/in-memory-session-store.ts diff --git a/apps/host-cloudflare/.gitignore b/apps/host-cloudflare/.gitignore new file mode 100644 index 000000000..818180624 --- /dev/null +++ b/apps/host-cloudflare/.gitignore @@ -0,0 +1,3 @@ +dist/ +.dev.vars +.wrangler/ diff --git a/apps/host-cloudflare/CHANGELOG.md b/apps/host-cloudflare/CHANGELOG.md new file mode 100644 index 000000000..8f5f5c719 --- /dev/null +++ b/apps/host-cloudflare/CHANGELOG.md @@ -0,0 +1,6 @@ +# @executor-js/host-cloudflare changelog + +This file exists for `changesets/action@v1` compatibility (it reads every +workspace package's `CHANGELOG.md` to build the Version Packages PR). +Canonical user-facing release notes are at `apps/cli/release-notes/next.md` +and on the GitHub Releases page. diff --git a/apps/host-cloudflare/README.md b/apps/host-cloudflare/README.md new file mode 100644 index 000000000..dbec3a4cc --- /dev/null +++ b/apps/host-cloudflare/README.md @@ -0,0 +1,89 @@ +# @executor-js/host-cloudflare + +Executor as a single Cloudflare Worker. The fourth app on the shared +`ExecutorApp.make` facade (alongside cloud, self-host, and local) — same code +paths, different injected providers: + +| Seam | Cloudflare provider | +| --------------- | --------------------------------------------------------------- | +| **identity** | Cloudflare Access JWT (`Cf-Access-Jwt-Assertion`) — no app login | +| **db** | D1 (SQLite) via the shared FumaDB assembly | +| **engine** | QuickJS-WASM, in-Worker (no extra binding) | +| **mcp** | Access-JWT auth + the shared in-process session store | +| **account** | `/account/me` from the Access principal (members/keys → Access) | +| **web** | the shared multiplayer SPA (Workers Static Assets) | + +Single-tenant: every Access-verified principal belongs to the one configured +org. Members and credentials are managed in Cloudflare Access, not in-app. + +## Surfaces + +- `GET /` — the shared Executor web UI (Sources, Connections, Secrets, + Policies) — the same shell as cloud/self-host, built by `vite build` into + `dist/` and served via Workers Static Assets (`single-page-application` + fallback for client routes). +- `/api/*` — the full Executor API (scopes, sources, secrets, account, …). +- `/mcp` — streamable-HTTP MCP with an `execute` tool. + +`run_worker_first` in `wrangler.jsonc` keeps `/api/*` + `/mcp` on the Worker; +everything else is the SPA. Every API/MCP route is gated by the Access JWT (401 +without). The SPA's auth context reads `/api/account/me`. + +## Deploy + +```bash +bunx wrangler login +bun run deploy:setup # apps/host-cloudflare — provisions D1 + secret + deploys +``` + +`deploy:setup` (scripts/deploy.sh) is idempotent: it creates/reuses the +`executor` D1 database, writes its id into `wrangler.jsonc`, generates + +uploads `EXECUTOR_SECRET_KEY`, and deploys. It then prints the one manual step. + +### The one manual step — Cloudflare Access + +The Worker returns 401 until it's behind a Cloudflare Access application. In the +Zero Trust dashboard: + +1. **Access → Applications → Add an application → Self-hosted** +2. Application domain: `executor-cloudflare..workers.dev` +3. Add an Access policy (e.g. _Emails ending in `@yourcompany.com`_) +4. Copy the Application **Audience (AUD)** tag, then: + ```bash + bunx wrangler deploy \ + --var ACCESS_AUD: \ + --var ACCESS_TEAM_DOMAIN:.cloudflareaccess.com + ``` + (or set them in `wrangler.jsonc` and redeploy) + +Now visiting the Worker prompts an Access login; the Worker validates the issued +JWT on every request. MCP clients present an Access JWT or +`Cf-Access-Client-Id`/`-Secret` service-token headers. + +## Local development + +```bash +# .dev.vars +EXECUTOR_SECRET_KEY=dev-secret-key-0123456789abcdef +ENABLE_DEV_AUTH=true # bypass Access; every request is a fixed dev admin + +bun run build # vite build -> dist/ (the SPA) +bunx wrangler dev --local # serves the SPA + Worker API together +``` + +`bun run dev:web` runs the Vite dev server (HMR) for UI work; point its API at a +running `wrangler dev` if you need live data. + +`ENABLE_DEV_AUTH` is a dev-only escape hatch — never set it in a deployed +environment (it disables the Access gate). + +## Notes + +- The QuickJS engine WASM is vendored into `src/quickjs-engine.wasm` (Workers + forbid runtime WASM compilation; it must be statically imported). Refresh it + after bumping the engine with `bun run vendor-wasm`. +- MCP sessions live in-process (one isolate owns a session). The cross-isolate + upgrade is a Durable Object behind the same `McpSessionStore` seam. +- When Cloudflare's dynamic Worker Loader leaves closed beta, the QuickJS code + substrate swaps for the dynamic-worker executor behind the `engine` seam — a + one-Layer change. diff --git a/apps/host-cloudflare/executor.config.ts b/apps/host-cloudflare/executor.config.ts new file mode 100644 index 000000000..265bd5e79 --- /dev/null +++ b/apps/host-cloudflare/executor.config.ts @@ -0,0 +1,24 @@ +import { defineExecutorConfig } from "@executor-js/sdk"; +import { openApiHttpPlugin } from "@executor-js/plugin-openapi/api"; +import { mcpHttpPlugin } from "@executor-js/plugin-mcp/api"; +import { graphqlHttpPlugin } from "@executor-js/plugin-graphql/api"; +import { encryptedSecretsPlugin } from "@executor-js/plugin-encrypted-secrets"; + +// --------------------------------------------------------------------------- +// Plugin list for the Cloudflare web build. The Vite `executorVitePlugin` reads +// this to assemble `virtual:executor/plugins-client` (the client-side plugin +// bundles the shell renders). It mirrors the runtime list in src/plugins.ts — +// same protocol/provider plugins as self-host. The encrypted-secrets key only +// matters at runtime (server side); a build-time placeholder is fine here since +// the client bundle never holds the key. +// --------------------------------------------------------------------------- + +export default defineExecutorConfig({ + plugins: () => + [ + openApiHttpPlugin(), + mcpHttpPlugin({ dangerouslyAllowStdioMCP: false }), + graphqlHttpPlugin(), + encryptedSecretsPlugin({ key: process.env.EXECUTOR_SECRET_KEY ?? "build-time-placeholder" }), + ] as const, +}); diff --git a/apps/host-cloudflare/package.json b/apps/host-cloudflare/package.json new file mode 100644 index 000000000..2332e8436 --- /dev/null +++ b/apps/host-cloudflare/package.json @@ -0,0 +1,52 @@ +{ + "name": "@executor-js/host-cloudflare", + "private": true, + "type": "module", + "scripts": { + "build": "vite build", + "deploy": "vite build && wrangler deploy", + "dev": "wrangler dev", + "dev:web": "vite dev", + "typecheck": "tsgo --noEmit", + "cf-typegen": "wrangler types", + "deploy:setup": "bash scripts/deploy.sh", + "vendor-wasm": "bun run scripts/vendor-quickjs-wasm.ts" + }, + "dependencies": { + "@effect/atom-react": "catalog:", + "@executor-js/api": "workspace:*", + "@executor-js/app": "workspace:*", + "@executor-js/execution": "workspace:*", + "@executor-js/host-mcp": "workspace:*", + "@executor-js/plugin-encrypted-secrets": "workspace:*", + "@executor-js/plugin-graphql": "workspace:*", + "@executor-js/plugin-mcp": "workspace:*", + "@executor-js/plugin-openapi": "workspace:*", + "@executor-js/react": "workspace:*", + "@executor-js/runtime-quickjs": "workspace:*", + "@executor-js/sdk": "workspace:*", + "@jitl/quickjs-wasmfile-release-sync": "catalog:", + "@modelcontextprotocol/sdk": "^1.29.0", + "@tanstack/react-router": "catalog:", + "drizzle-orm": "catalog:", + "effect": "catalog:", + "fumadb": "workspace:*", + "jose": "^5.9.6", + "quickjs-emscripten-core": "0.31.0", + "react": "catalog:", + "react-dom": "catalog:" + }, + "devDependencies": { + "@cloudflare/workers-types": "^4.20250410.0", + "@executor-js/vite-plugin": "workspace:*", + "@tailwindcss/vite": "catalog:", + "@tanstack/router-plugin": "^1.167.12", + "@types/node": "catalog:", + "@types/react": "catalog:", + "@types/react-dom": "catalog:", + "@vitejs/plugin-react": "catalog:", + "typescript": "catalog:", + "vite": "catalog:", + "wrangler": "^4.95.0" + } +} diff --git a/apps/host-cloudflare/scripts/deploy.sh b/apps/host-cloudflare/scripts/deploy.sh new file mode 100755 index 000000000..4d8a2857e --- /dev/null +++ b/apps/host-cloudflare/scripts/deploy.sh @@ -0,0 +1,88 @@ +#!/usr/bin/env bash +# One-shot deploy for the Executor Cloudflare host. +# +# Provisions everything a fresh account needs and deploys the Worker: +# 1. verifies wrangler is logged in +# 2. creates (or reuses) the `executor` D1 database and writes its id into +# wrangler.jsonc +# 3. generates + uploads EXECUTOR_SECRET_KEY (the at-rest secret key) if unset +# 4. deploys the Worker +# 5. prints the single manual step: the Cloudflare Access application +# +# Idempotent — safe to re-run. Run from anywhere: +# bash apps/host-cloudflare/scripts/deploy.sh +set -euo pipefail + +SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)" +APP_DIR="$(cd "$SCRIPT_DIR/.." && pwd)" +CONFIG="$APP_DIR/wrangler.jsonc" +cd "$APP_DIR" + +step() { printf '\n\033[1;36m==> %s\033[0m\n' "$1"; } +info() { printf ' %s\n' "$1"; } + +step "Checking wrangler login" +if ! bunx wrangler whoami >/dev/null 2>&1; then + info "Not logged in. Run: bunx wrangler login" + exit 1 +fi +info "Logged in." + +step "Provisioning D1 database 'executor'" +# `d1 create` is non-idempotent (errors if it exists), so list first. +EXISTING_ID="$(bunx wrangler d1 list --json 2>/dev/null \ + | node -e 'let s="";process.stdin.on("data",d=>s+=d).on("end",()=>{try{const r=JSON.parse(s).find(d=>d.name==="executor");process.stdout.write(r?r.uuid:"")}catch{}})')" +if [ -n "$EXISTING_ID" ]; then + DB_ID="$EXISTING_ID" + info "Reusing existing database: $DB_ID" +else + CREATE_OUT="$(bunx wrangler d1 create executor 2>&1)" + DB_ID="$(printf '%s' "$CREATE_OUT" | grep -oE '[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}' | head -1)" + info "Created database: $DB_ID" +fi +[ -n "$DB_ID" ] || { echo "Failed to resolve D1 database id" >&2; exit 1; } + +step "Writing D1 id into wrangler.jsonc" +# Replace whatever database_id is present (placeholder or a prior id). +node -e ' + const fs=require("fs"),p=process.argv[1],id=process.argv[2]; + let t=fs.readFileSync(p,"utf8"); + t=t.replace(/("database_id":\s*")[^"]*(")/, `$1${id}$2`); + fs.writeFileSync(p,t); +' "$CONFIG" "$DB_ID" +info "wrangler.jsonc -> $DB_ID" + +step "Ensuring EXECUTOR_SECRET_KEY secret" +if bunx wrangler secret list 2>/dev/null | grep -q EXECUTOR_SECRET_KEY; then + info "Secret already set — leaving it." +else + SECRET="$(node -e 'console.log(require("node:crypto").randomBytes(32).toString("hex"))')" + printf '%s' "$SECRET" | bunx wrangler secret put EXECUTOR_SECRET_KEY >/dev/null + info "Generated + uploaded a fresh 32-byte key." +fi + +step "Building the web SPA" +bunx vite build + +step "Deploying Worker" +bunx wrangler deploy + +cat <<'NEXT' + +==> One manual step left: turn on Cloudflare Access (the auth layer) + + The Worker is deployed but every request returns 401 until you put it behind + a Cloudflare Access application. In the Zero Trust dashboard: + + 1. Access -> Applications -> Add an application -> Self-hosted + 2. Application domain: executor-cloudflare..workers.dev + 3. Add an Access policy (e.g. "Emails ending in @yourcompany.com") + 4. After saving, copy the Application Audience (AUD) tag, then set: + bunx wrangler deploy --var ACCESS_AUD: \ + --var ACCESS_TEAM_DOMAIN:.cloudflareaccess.com + (or edit the vars in wrangler.jsonc and redeploy) + + That's it — visiting the Worker URL now prompts a Cloudflare Access login, + and the Worker validates the issued JWT on every request. + +NEXT diff --git a/apps/host-cloudflare/scripts/vendor-quickjs-wasm.ts b/apps/host-cloudflare/scripts/vendor-quickjs-wasm.ts new file mode 100755 index 000000000..1518babf4 --- /dev/null +++ b/apps/host-cloudflare/scripts/vendor-quickjs-wasm.ts @@ -0,0 +1,18 @@ +// Vendors the QuickJS engine WASM into src/ so wrangler's CompiledWasm module +// rule (rooted at the app dir) can statically compile it at build time. Workers +// forbid runtime WASM compilation, and the rule's glob won't reach the +// monorepo-root node_modules, so the bytes must live inside this app. +// +// Re-run after bumping @jitl/quickjs-wasmfile-release-sync: +// bun run scripts/vendor-quickjs-wasm.ts +import { copyFileSync } from "node:fs"; +import { createRequire } from "node:module"; +import { dirname, join } from "node:path"; +import { fileURLToPath } from "node:url"; + +const require = createRequire(import.meta.url); +const source = require.resolve("@jitl/quickjs-wasmfile-release-sync/wasm"); +const dest = join(dirname(fileURLToPath(import.meta.url)), "..", "src", "quickjs-engine.wasm"); + +copyFileSync(source, dest); +console.log(`vendored ${source} -> ${dest}`); diff --git a/apps/host-cloudflare/src/account/account-provider.ts b/apps/host-cloudflare/src/account/account-provider.ts new file mode 100644 index 000000000..6836cd077 --- /dev/null +++ b/apps/host-cloudflare/src/account/account-provider.ts @@ -0,0 +1,74 @@ +import { Effect, Layer } from "effect"; + +import { + AccountProvider, + accountProviderMiddlewareLayer, + type AccountHeaders, +} from "@executor-js/api/server"; +import { AccountError, AccountUnauthorized } from "@executor-js/api"; + +import { makeAccessVerifier } from "../auth/cloudflare-access"; +import type { CloudflareConfig } from "../config"; + +// --------------------------------------------------------------------------- +// Cloudflare AccountProvider — backs the shared `/account/*` surface the +// multiplayer shell reads. Cloudflare Access is the identity, so `me` just +// reflects the Access principal (the same `makeAccessVerifier` the API gate +// uses), reading the `Cf-Access-Jwt-Assertion` header off the request. +// +// Single-tenant + Access-managed: members, roles, and API keys live in +// Cloudflare Access, NOT in the app. The shell hides the API-keys footer and +// shows no members page, so those methods are never reached from the UI; they +// return empty (reads) or a clear "managed by Cloudflare Access" error (writes) +// to satisfy the provider shape. +// --------------------------------------------------------------------------- + +const NOT_IN_APP = "Managed by Cloudflare Access, not in the app."; + +export const cloudflareAccountProvider = ( + config: CloudflareConfig, +): Layer.Layer => { + const { verify } = makeAccessVerifier(config); + + // The provider gets raw headers; rebuild a minimal Request so `verify` can + // read the Access assertion header (and honor the dev-auth bypass). + const principalFrom = (headers: AccountHeaders) => + verify(new Request("https://internal.local/", { headers: new Headers(headers) })); + + const forbiddenWrite = Effect.fail(new AccountError({ message: NOT_IN_APP })); + + return Layer.succeed(AccountProvider)({ + me: (headers) => + principalFrom(headers).pipe( + Effect.flatMap((principal) => + principal + ? Effect.succeed({ + user: { + id: principal.accountId, + email: principal.email, + name: principal.name, + avatarUrl: principal.avatarUrl, + }, + organization: { + id: principal.organizationId, + name: principal.organizationName, + }, + }) + : Effect.fail(new AccountUnauthorized()), + ), + ), + listApiKeys: () => Effect.succeed({ apiKeys: [] }), + createApiKey: () => forbiddenWrite, + revokeApiKey: () => forbiddenWrite, + listMembers: () => Effect.succeed({ members: [] }), + listRoles: () => Effect.succeed({ roles: [] }), + inviteMember: () => forbiddenWrite, + removeMember: () => forbiddenWrite, + updateMemberRole: () => forbiddenWrite, + updateOrgName: () => forbiddenWrite, + }); +}; + +/** The per-request `AccountProvider` middleware (mounted under `/api`). */ +export const cloudflareAccountMiddleware = (config: CloudflareConfig) => + accountProviderMiddlewareLayer(cloudflareAccountProvider(config)); diff --git a/apps/host-cloudflare/src/app.ts b/apps/host-cloudflare/src/app.ts new file mode 100644 index 000000000..c98c23429 --- /dev/null +++ b/apps/host-cloudflare/src/app.ts @@ -0,0 +1,72 @@ +import { Effect } from "effect"; + +import { dbProviderLayer, ExecutorApp, textFailureStrategy } from "@executor-js/api/server"; + +import { loadConfig, type CloudflareEnv } from "./config"; +import { makeCloudflarePlugins } from "./plugins"; +import { createD1ExecutorDb } from "./db/d1"; +import { cloudflareAccessIdentityLayer } from "./auth/cloudflare-access"; +import { + CloudflareCodeExecutorProvider, + makeCloudflareHostConfig, + makeCloudflarePluginsProvider, +} from "./execution"; +import { ErrorCaptureLive } from "./observability"; +import { cloudflareAccountMiddleware } from "./account/account-provider"; +import { makeCloudflareMcpSeams } from "./mcp"; +import { preloadQuickJs } from "./quickjs"; + +// =========================================================================== +// The Cloudflare host, as ONE `ExecutorApp.make` call — the 4th app alongside +// cloud / self-host / local, differing only by the injected Layers. +// +// The whole scenario in 60 seconds: Cloudflare Access is the identity (validate +// the Cf-Access-Jwt-Assertion JWT — no Better Auth, no WorkOS, no app login), +// D1 is the SQLite store (same FumaDB assembly as self-host), QuickJS is the +// in-process code substrate, no billing, single-tenant. `diff` against +// host-selfhost/src/app.ts is three injected Layers: identity, db, plugins/config. +// +// Built per isolate (async) so the D1 schema bring-up happens once at first +// fetch; `env` arrives with that fetch (a Worker has no module-scope bindings), +// so the providers close over it instead of reading process.env. +// =========================================================================== + +export const makeCloudflareApp = async (env: CloudflareEnv) => { + const config = loadConfig(env); + const plugins = makeCloudflarePlugins(config.secretKey); + + // Load the Workers-compatible (WASM-inlined) QuickJS variant before any + // executor is built — the default variant can't fetch its .wasm on Workers. + await preloadQuickJs(); + + // Open + idempotently bring up the D1 schema once (the long-lived handle the + // per-request scoped executor reads through the DbProvider seam). + const dbHandle = await createD1ExecutorDb(env.DB, env.BLOBS, plugins); + const identityLayer = cloudflareAccessIdentityLayer(config); + const mcp = makeCloudflareMcpSeams(config, dbHandle); + + const { appLayer, toWebHandler } = ExecutorApp.make({ + plugins, + providers: { + identity: identityLayer, + db: dbProviderLayer(Effect.succeed(dbHandle)), + engine: { codeExecutor: CloudflareCodeExecutorProvider }, // decorator defaults to no-op + plugins: { + provider: makeCloudflarePluginsProvider(config), + config: makeCloudflareHostConfig(config), + }, + errorCapture: ErrorCaptureLive, + // The account API (`/api/account/*`) backs the shared multiplayer shell's + // auth context; `me` reflects the Access principal. Members/keys are + // Access-managed, so the rest of the surface is stubbed. + account: cloudflareAccountMiddleware(config), + // The MCP serving envelope: Access-JWT auth + the shared in-process session + // store over the QuickJS engine. + mcp: { auth: mcp.auth, sessions: mcp.sessions, reporter: mcp.reporter }, + }, + config: { mountPrefix: "/api", failure: textFailureStrategy }, + boot: identityLayer, + }); + + return { appLayer, toWebHandler }; +}; diff --git a/apps/host-cloudflare/src/auth/cloudflare-access.ts b/apps/host-cloudflare/src/auth/cloudflare-access.ts new file mode 100644 index 000000000..24103ec57 --- /dev/null +++ b/apps/host-cloudflare/src/auth/cloudflare-access.ts @@ -0,0 +1,93 @@ +import { createRemoteJWKSet, jwtVerify } from "jose"; +import { Effect, Layer } from "effect"; + +import { IdentityProvider, Unauthorized, type Principal } from "@executor-js/api/server"; + +import type { CloudflareConfig } from "../config"; + +// --------------------------------------------------------------------------- +// Cloudflare Access IdentityProvider — the CF-native swap for self-host's +// Better Auth. Cloudflare Access (Zero Trust) sits IN FRONT of the Worker and +// authenticates the human; it forwards a signed `Cf-Access-Jwt-Assertion` JWT. +// This provider verifies that JWT against the team's public JWKS and maps its +// claims onto the neutral `Principal`. There is no app-level login, no session +// store, no password — the IdP is the gate. +// +// Single-tenant: every verified principal belongs to the one configured org. +// Roles come from the admin allowlist + the Access groups claim. +// --------------------------------------------------------------------------- + +/** + * Resolve a request to its verified `Principal`, or `null` when the Access + * assertion is missing/invalid. The single source of truth for "who is this + * request", shared by the `IdentityProvider` (the API gate) and the MCP auth + * provider (the `/mcp` gate) so both enforce Access identically. + * + * `jose` caches + rotates the team JWKS, so build the verifier once per config. + */ +export const makeAccessVerifier = (config: CloudflareConfig) => { + const issuer = `https://${config.accessTeamDomain}`; + // Cached, lazily-fetched team signing keys; jose handles rotation + caching. + const jwks = createRemoteJWKSet(new URL(`${issuer}/cdn-cgi/access/certs`)); + + // Dev/single-user escape hatch: bypass Access entirely, every request is a + // fixed admin. Only when explicitly enabled (and the instance is otherwise + // unprotected). Mirrors the local app's single-user model. + const devPrincipal: Principal = { + accountId: "dev", + organizationId: config.organizationId, + organizationName: config.organizationName, + email: config.adminEmails[0] ?? "dev@local", + name: "Dev", + avatarUrl: null, + roles: ["admin"], + }; + + const verify = (request: Request): Effect.Effect => + Effect.gen(function* () { + if (config.enableDevAuth) return devPrincipal; + const token = request.headers.get("Cf-Access-Jwt-Assertion"); + if (!token) return null; + + const verified = yield* Effect.tryPromise({ + try: () => jwtVerify(token, jwks, { issuer, audience: config.accessAud }), + catch: () => "invalid access assertion", + }).pipe(Effect.orElseSucceed(() => null)); + if (!verified) return null; + + const claims = verified.payload as Record; + const email = typeof claims.email === "string" ? claims.email : ""; + const nameClaim = claims[config.accessNameClaim]; + const groupsClaim = claims[config.accessGroupsClaim]; + const groups = Array.isArray(groupsClaim) ? groupsClaim.map(String) : []; + const isAdmin = email.length > 0 && config.adminEmails.includes(email.toLowerCase()); + + return { + accountId: typeof claims.sub === "string" && claims.sub.length > 0 ? claims.sub : email, + organizationId: config.organizationId, + organizationName: config.organizationName, + email, + name: typeof nameClaim === "string" ? nameClaim : null, + avatarUrl: null, + roles: isAdmin ? ["admin", ...groups] : groups.length > 0 ? groups : ["member"], + } satisfies Principal; + }); + + return { verify }; +}; + +export const cloudflareAccessIdentityLayer = ( + config: CloudflareConfig, +): Layer.Layer => { + const { verify } = makeAccessVerifier(config); + return Layer.succeed(IdentityProvider)( + IdentityProvider.of({ + authenticate: (request) => + verify(request).pipe( + Effect.flatMap((principal) => + principal ? Effect.succeed(principal) : Effect.fail(new Unauthorized()), + ), + ), + }), + ); +}; diff --git a/apps/host-cloudflare/src/config.ts b/apps/host-cloudflare/src/config.ts new file mode 100644 index 000000000..10294bac5 --- /dev/null +++ b/apps/host-cloudflare/src/config.ts @@ -0,0 +1,86 @@ +import type { D1Database, R2Bucket } from "@cloudflare/workers-types"; + +// --------------------------------------------------------------------------- +// Cloudflare host config. Unlike self-host (process.env + a data dir), a Worker +// receives its bindings + vars per request as `env`, so config is derived from +// that object — there is no process.env, no filesystem, no boot-time secret +// generation. Identity comes entirely from Cloudflare Access in front of the +// Worker; the only real secret is the at-rest secret-encryption key. +// --------------------------------------------------------------------------- + +export const CLOUDFLARE_NAMESPACE = "executor_cloudflare"; +export const CLOUDFLARE_SCHEMA_VERSION = "1.0.0"; + +export interface CloudflareEnv { + /** D1 database binding — the app's SQLite store. */ + readonly DB: D1Database; + /** R2 bucket binding — holds values too large for a D1 row (~1-2MB cap). */ + readonly BLOBS?: R2Bucket; + /** Zero Trust team domain, e.g. `your-team.cloudflareaccess.com`. */ + readonly ACCESS_TEAM_DOMAIN: string; + /** The Access application's AUD tag (the JWT audience to verify). */ + readonly ACCESS_AUD: string; + /** Claim holding the display name (default `name`). */ + readonly ACCESS_NAME_CLAIM?: string; + /** Claim holding the user's groups (default `groups`). */ + readonly ACCESS_GROUPS_CLAIM?: string; + /** Comma-separated emails granted the admin role. */ + readonly ADMIN_EMAILS?: string; + /** The single organization id/name every authenticated user belongs to. */ + readonly SELF_HOSTED_ORG_ID?: string; + readonly SELF_HOSTED_ORG_NAME?: string; + /** At-rest secret-encryption key (a `wrangler secret`, NOT a var). */ + readonly EXECUTOR_SECRET_KEY?: string; + readonly ALLOW_LOCAL_NETWORK?: string; + readonly VITE_PUBLIC_SITE_URL?: string; + /** + * Dev/single-user escape hatch: when "true", skip Cloudflare Access entirely + * and treat every request as a fixed admin. For local `wrangler dev` and + * unattended validation only — NEVER set on a deployment that isn't already + * behind Access, or the instance is wide open. + */ + readonly ENABLE_DEV_AUTH?: string; +} + +export interface CloudflareConfig { + readonly accessTeamDomain: string; + readonly accessAud: string; + readonly accessNameClaim: string; + readonly accessGroupsClaim: string; + readonly adminEmails: readonly string[]; + readonly organizationId: string; + readonly organizationName: string; + readonly secretKey: string; + readonly allowLocalNetwork: boolean; + readonly webBaseUrl: string; + readonly enableDevAuth: boolean; +} + +const splitLower = (value: string | undefined): readonly string[] => + (value ?? "") + .split(",") + .map((part) => part.trim().toLowerCase()) + .filter((part) => part.length > 0); + +export const loadConfig = (env: CloudflareEnv): CloudflareConfig => { + const secretKey = env.EXECUTOR_SECRET_KEY?.trim(); + if (!secretKey || secretKey.length < 16) { + // oxlint-disable-next-line executor/no-try-catch-or-throw, executor/no-error-constructor -- boundary: the Worker must not boot without the at-rest secret key + throw new Error( + "EXECUTOR_SECRET_KEY must be set (wrangler secret put EXECUTOR_SECRET_KEY) — it encrypts stored secrets at rest in D1", + ); + } + return { + accessTeamDomain: env.ACCESS_TEAM_DOMAIN.replace(/^https?:\/\//, "").replace(/\/+$/, ""), + accessAud: env.ACCESS_AUD, + accessNameClaim: env.ACCESS_NAME_CLAIM ?? "name", + accessGroupsClaim: env.ACCESS_GROUPS_CLAIM ?? "groups", + adminEmails: splitLower(env.ADMIN_EMAILS), + organizationId: env.SELF_HOSTED_ORG_ID ?? "default", + organizationName: env.SELF_HOSTED_ORG_NAME ?? "Default", + secretKey, + allowLocalNetwork: env.ALLOW_LOCAL_NETWORK === "true", + webBaseUrl: env.VITE_PUBLIC_SITE_URL ?? "https://localhost", + enableDevAuth: env.ENABLE_DEV_AUTH === "true", + }; +}; diff --git a/apps/host-cloudflare/src/db/d1.ts b/apps/host-cloudflare/src/db/d1.ts new file mode 100644 index 000000000..e6270aacd --- /dev/null +++ b/apps/host-cloudflare/src/db/d1.ts @@ -0,0 +1,71 @@ +import { drizzle } from "drizzle-orm/d1"; +import { + createDrizzleRuntimeSchemaFromTables, + ensureDrizzleRuntimeSchemaFromTables, +} from "fumadb/adapters/drizzle"; +import type { D1Database, R2Bucket } from "@cloudflare/workers-types"; + +import { wrapD1WithR2Offload } from "./r2-blob-offload"; + +import { + collectTables, + createExecutorFumaDb, + type ExecutorDbHandle, +} from "@executor-js/api/server"; + +import { CLOUDFLARE_NAMESPACE, CLOUDFLARE_SCHEMA_VERSION } from "../config"; +import type { CloudflarePlugins } from "../plugins"; + +// --------------------------------------------------------------------------- +// D1 DbProvider handle — the CF-native swap for self-host's libSQL handle. +// +// D1 is SQLite, so this reuses the SAME shared FumaDB assembly self-host uses: +// build the runtime schema from the plugins' tables, open drizzle over the D1 +// binding (drizzle-orm/d1), run the idempotent `ensureDrizzleRuntimeSchemaFrom- +// Tables` bring-up (generic CREATE TABLE IF NOT EXISTS over D1), and assemble +// `createExecutorFumaDb`. No driver to open (the binding is the connection), no +// PRAGMAs, no `close` teardown. +// --------------------------------------------------------------------------- + +export const createD1ExecutorDb = async ( + db: D1Database, + blobs: R2Bucket | undefined, + plugins: CloudflarePlugins, +): Promise => { + const options = { + tables: collectTables(plugins), + namespace: CLOUDFLARE_NAMESPACE, + version: CLOUDFLARE_SCHEMA_VERSION, + provider: "sqlite" as const, + }; + + // Offload oversized values to R2 (D1 caps a value at ~1-2MB). No-op for + // ordinary small rows; only multi-MB values (e.g. a large OpenAPI spec) leave + // D1. Without a bucket bound, fall back to plain D1 (small values only). + const connection = blobs ? wrapD1WithR2Offload(db, blobs) : db; + const schema = createDrizzleRuntimeSchemaFromTables(options); + const drizzleDb = drizzle(connection, { schema }); + + // D1 rejects SQL `BEGIN TRANSACTION` / `SAVEPOINT` (it requires the JS batch + // API), and the shared ensure wraps its DDL in a transaction when the handle + // exposes one. The bring-up is idempotent `CREATE TABLE IF NOT EXISTS`, so run + // it WITHOUT a transaction by handing the ensure a run-only view of the handle. + await ensureDrizzleRuntimeSchemaFromTables({ run: (query) => drizzleDb.run(query) }, options); + + // `interactiveTransactions: false` — D1 rejects interactive transactions, so + // the fuma adapter runs transaction callbacks directly (auto-commit per + // statement). Without this, every runtime write that wraps in a transaction + // (adding a source, etc.) emits `BEGIN` and 500s. libSQL keeps real + // transactions; D1 (same `provider: "sqlite"`) opts out here. + const { db: fumaDb, fuma } = createExecutorFumaDb(drizzleDb, { + ...options, + interactiveTransactions: false, + }); + + return { + db: fumaDb, + fuma, + // The D1 binding owns its own lifecycle; nothing to release. + close: async () => {}, + }; +}; diff --git a/apps/host-cloudflare/src/db/r2-blob-offload.ts b/apps/host-cloudflare/src/db/r2-blob-offload.ts new file mode 100644 index 0000000000000000000000000000000000000000..c4a113ab7b4d1d0b058ba77917ce4e4601d39271 GIT binary patch literal 9133 zcmb_h?Q+}3742_7#hT+uL5Bn-b(&`MSt*iZw~nbwjFXN>BZ9d)U$59cDBC9+2{WRC}DA)0M z5fyr-vw~lqXzgALod4tPo59KD zpx-}w^L0B^=Vqq;ITW_YlR`sQuGOp@Po1{8Xr{xfP!&_H`g5Hfp1$$BRFb7h#yy#W z(g}9v+M4vEjw#U2^;iY(bw1YVAFWEP`spv<9JR5lFv?_F4V{sfwlH~grNbDp9ID(b zLN%CT`68!rJok8$0!K*}!#rgTPF$*yDYIC?VbM$%I#=c+{)^OTS!is6CR3BfJeHOf zI#W0nQHV0p4!M#>V~qtF{kTYqDK-}g1kVjrge>RH9q0FdH-E^Y|?U; z(b`y#O$;rrbm5!;9a34;QJJQ#+~ieiS1IwPKrUbd;?Bpg4CivOcq_`6Dj4b1EGl){ z9lA3q=qGn}opV$I&cb0jwkk8qj-hU(t~0Ypb$q3_xsUm%L>;jxO6jU)*Xlfp(&R@t z*twC?BqeRA{;rq!eze4iaCBCvX=JA=NMeoZmM=bs`EfZ%mLBUA(M9^m%EZ90>5{@y z9ere=HG^tKKj?9x0+Y|Ds3OT?XdBIUSR4zj=Wqc`jMStoN+fDBo99RvqD1Yx0sWa9 zE=^5#)kO}>)Fip#MqiI9EKLzHWUO`-B57{b#{|iP{rX0aOFX59!%=ERcGx?@k8{~! zbu?>BNx@mNe$YSeGX>|!AJl;Dxr1yEYGlzoVO)P#D5AVWgv4ZKmW=7lZizC!)(E3z z6=yo#hMy$c9EL1Ri9(u+yNwzFW~Rj8!*|CNW{U`aNc|M7T745C60_(k8M7d;d=jOW z;+u*IpCR(LP^bMj?*=Dlm#1eZuikvG_EhT+mzR|bFY~QSdhqh&=H=*5ldWj;@^agQ zbKk?K%cu&g3d9~>g%UFY#J7W2-7f_XkaOSZG*ti$1owCoaP-qAFcIk4p$$xPL1*BY zDX*pwf&wx*;D#mRVnSrHDj-C(s|qwk%CoJ?p8l&>Z~KSGmq-63(7rx9Ie*=Mdknk2 z+}OC>*x1$%KX;=6SR{l0Vwp-ZHhfuWp|yVgWLO z)>~|$&~H)mU&&Y<|%W=MmXK zUIbem)!Jx@z+3|nGH%#;c3108NCHmbn8+?OG%}I9y`mH>I0chPtlo7o+J`An$d!HX z#jThhM2iS8InI~!!i2UQ6)8Ghf>JMn*7@th?$)2bXmz~ZkwqAZuNh8N&Qa&4LQJJ+@^BsVGrSLV{Ihzj;V$(o1ve8N~ z_}%&8Hzy)*8iDLVw=62q%5b&=q#zP)73f8(y8Eli)nRg4?APc9q!GR$ z!-cN#)g2e-&B3vRV^%=32ewItw^eJ@QlC_-XzjS5t)_%(@~3uPBOwqcZdV~j{#4IC zsjP$%z7moNPzFpC$?V*|w})hRCbZg8EJ|^aJPkco?Cz=cvTaxHq;%HGdX@Pi4&6^D zPijI{J0y!k*lcSt@CN%4E&9! zkE+vg^nDZ&ac$fH9xAn>Lzvk2iC%bbRQ~?08i}`+TJg#+=oLDU?6{bV%aI;d<1(=B z2AJT*KQu(vs^`cUNvY31le^OWRB~*oPNn8cWU{QB;*!bxyFV*F2 zQ&5RL^}HMnMXX${Bxg48$)k@T@smZQ;1=gpVK4SOw8Y>(8DSUey?pshy;R@vW+YdR zx~Sc?1H7D9iX9Y-Tqcx`KnMI);{Gjya)RM5x;_Zy{w|?pe|z^@FZYKaxdXsmwH`Kr zvI@fz2y>PJ{)BW|@UZzjNtcMg%LY2<5!gb_ufUekNgunB5Z-$t)(WbQG}?xys3*}d zFEblrMb9^N)+`w!dj1L#+W^&cuhHu=Zd!<$S{`TR*cT3+wLo}5@lG=$2 zXVE70k(FkCbzcM=kxHz?fne9dvRL{XFA+%zqo}Iwt1R(hi0Xe&q9SM2Jh9( z40qG_1yG0F4K;8R0>Zl6TvTOLM``eHWUS>qGAF+cn{d_=-pgE~raS%sAFf{$QU+Au zn;`$ZF4qb&s*WOpX`_Q3+|$YB;={&8Bg%!3Uwc7Y z?Hxrz0!pk}zUEr>$^On*1>6S{*KGzFzV1%gMPS658OJwVnoWH(4Tv?p2NMP)~U zz)vt#kZ-Db#)x35bDRokLf&nHj$MGpj7^@GbGKgzP(VpB*dIU)H$_iKC@sS!DoJ?> zC}XhnDy8MtTW56bS)6ospGN^uJc)Ap^I{=)oQjN%Q>4eXBUEc#%Be1(fhP`MLlq35 zE4gLGo&>juFEUZ^JXD4k(jN$wZln>mA<-9w3nl3dSk-|qJr|fTYAy>w8!g+_oPSv0 z>cX2w(;w_E}@=VAXlH0#{G$t8?AoMxHzXRMAnp zng-GJ{=V`7#M5{83tnCN5>K!(Tv)UXpm@8YAFQc|C3Oq+`Qd%&;D8)83`1-q53Qf@ zl#3eIYB#-Sy}RP9s#}uY5j7GFA0sE6ZhXq!ys+&K_Ng#(Xz<|zR`aSo!7u@1vvmir zxEE{pv3PCEJs_b__34w`zALUvLcCGuJy+0PukVA7!spUY#G?@IeS_~w1UyUNUqZB9 zh7l*+=RgIu)6UF-LU=oSA~Py;+gwxK4+s0qdH1PrjUkYVpe|Z55drre^B>D5leM3Ne4TrFR70QTC&K; zqIO&?zFm`aKn#aW6t~M<`K#lAb21adZ<2^ zjsDNL3!drTNht8C9>`8_lH|7N<2oLj=#l7tXo*i+7p?>0xH4;^Bhje!JQIBOspfx3E(h&)hniGE;yw~ z@H&>)0IP<4hk>DsuhgM1>IgVrV7`DiXMAk~nIIw@*;6-uTqUqn)4gnz7h7--*ri>wU2!pF%owwqDS27$Hqsh9LhkQxYh-^IREA9c2q{ra1 zRXW*0_lfllQ>E62i)5aNNuvA|hDWOT+?!($LZ`9h9G{33fvt^(DpC+fh^va=bjM|B z$^G(lFv9PfGF%r{hw~Bk>5i*`TBZ-~yPrW1#IdR{pA6o6zNIihNZe{1bLr=a5$f?@ zrOuc4(EolPiASMd?3SYJiN;<{AxV%@7YkV9W3Y1}u7WJtu(I6CA<24F8EoOR>TC%z zsTdYlBKarKNFH(ccdkJi3{e#C`5U$@wI|a-zW{Ytz3sVchbucp5(Dq = Layer.sync( + CodeExecutorProvider, + () => makeQuickJsExecutor(), +); + +export const makeCloudflarePluginsProvider = ( + config: CloudflareConfig, +): Layer.Layer => + Layer.succeed(PluginsProvider)({ + plugins: () => makeCloudflarePlugins(config.secretKey), + }); + +export const makeCloudflareHostConfig = (config: CloudflareConfig): Layer.Layer => + Layer.succeed(HostConfig)({ + allowLocalNetwork: config.allowLocalNetwork, + webBaseUrl: config.webBaseUrl, + }); + +/** + * The five execution-stack seams the shared `makeExecutionStack` reads from, + * bundled into one Layer over the long-lived D1 handle. Mirrors self-host's + * `SelfHostExecutionStackLayer`. The HTTP path wires these seams individually + * through `ExecutorApp.make`; the MCP session store provides this whole Layer to + * build a per-session engine off the envelope's request pipeline. + */ +export const makeCloudflareExecutionStackLayer = ( + config: CloudflareConfig, + dbHandle: ExecutorDbHandle, +): Layer.Layer< + DbProvider | PluginsProvider | HostConfig | CodeExecutorProvider | EngineDecorator +> => + Layer.mergeAll( + dbProviderLayer(Effect.succeed(dbHandle)), + makeCloudflarePluginsProvider(config), + makeCloudflareHostConfig(config), + CloudflareCodeExecutorProvider, + EngineDecoratorNoop, + ); diff --git a/apps/host-cloudflare/src/mcp/auth.ts b/apps/host-cloudflare/src/mcp/auth.ts new file mode 100644 index 000000000..8a55033a7 --- /dev/null +++ b/apps/host-cloudflare/src/mcp/auth.ts @@ -0,0 +1,35 @@ +import { Effect, Layer } from "effect"; + +import { authenticated, McpAuthProvider, unauthorized } from "@executor-js/host-mcp"; + +import { makeAccessVerifier } from "../auth/cloudflare-access"; +import type { CloudflareConfig } from "../config"; + +// --------------------------------------------------------------------------- +// Cloudflare Access McpAuthProvider — the `/mcp` gate, identical identity to the +// API gate. Cloudflare Access sits in front of the Worker and forwards the +// signed `Cf-Access-Jwt-Assertion` on every request, including `/mcp`. So the +// MCP auth seam reuses the SAME `makeAccessVerifier` the IdentityProvider uses: +// validate the JWT, map claims onto the neutral `Principal`, done. +// +// There is no MCP OAuth here. Auth is Access's browser/service-token flow, not +// the MCP `/authorize`+`/token` dance — so `discoveryRoutes` is empty and the +// 401 challenge points at a nominal protected-resource URL only to satisfy +// clients that probe for it. An external MCP client authenticates by presenting +// an Access JWT (or `Cf-Access-Client-Id`/`-Secret` service-token headers, which +// Access converts to one). When MCP OAuth-over-Access is needed, add the +// discovery docs + a token endpoint here behind this same seam. +// --------------------------------------------------------------------------- + +export const cloudflareAccessMcpAuth = (config: CloudflareConfig): Layer.Layer => { + const { verify } = makeAccessVerifier(config); + return Layer.succeed(McpAuthProvider)({ + discoveryRoutes: [], + resourceMetadataUrl: (request) => + new URL("/.well-known/oauth-protected-resource", new URL(request.url).origin).toString(), + authenticate: (request) => + verify(request).pipe( + Effect.map((principal) => (principal ? authenticated(principal) : unauthorized())), + ), + }); +}; diff --git a/apps/host-cloudflare/src/mcp/index.ts b/apps/host-cloudflare/src/mcp/index.ts new file mode 100644 index 000000000..39dadc36f --- /dev/null +++ b/apps/host-cloudflare/src/mcp/index.ts @@ -0,0 +1,63 @@ +import type { Layer } from "effect"; + +import type { ExecutorDbHandle } from "@executor-js/api/server"; +import type { McpAuthProvider, McpErrorReporter, McpSessionStore } from "@executor-js/host-mcp"; + +import type { CloudflareConfig } from "../config"; +import { cloudflareAccessMcpAuth } from "./auth"; +import { + cloudflareMcpReporter, + cloudflareMcpSessions, + makeCloudflareMcpSessionStore, +} from "./session-store"; + +export { cloudflareAccessMcpAuth } from "./auth"; +export { + cloudflareMcpReporter, + cloudflareMcpSessions, + makeCloudflareMcpSessionStore, +} from "./session-store"; + +// --------------------------------------------------------------------------- +// The Cloudflare MCP serving seams, fed to `ExecutorApp.make`'s `mcp` group. +// +// `ExecutorApp.make` mounts the shared, provider-neutral MCP serving envelope +// (@executor-js/host-mcp) at the top-level `/mcp`, outside the API's execution +// middleware. The Cloudflare host provides the two envelope seams plus the +// error-reporter override: +// - McpAuthProvider -> `cloudflareAccessMcpAuth`: validate the Access JWT +// (same identity as the API gate); no MCP OAuth. +// - McpSessionStore -> `cloudflareMcpSessions`: the shared in-process store +// over the QuickJS engine + long-lived D1 handle. +// - McpErrorReporter -> `cloudflareMcpReporter`: route 500 defects through the +// host's console capture. +// --------------------------------------------------------------------------- + +export interface CloudflareMcpSeams { + /** Validate the Access JWT to an MCP `AuthOutcome`; declares no discovery routes. */ + readonly auth: Layer.Layer; + /** The in-process session store seam (dispatch + lifetime). */ + readonly sessions: Layer.Layer; + /** Route 500 defects through the host's console `ErrorCapture`. */ + readonly reporter: Layer.Layer; + /** Dispose all live in-process MCP sessions at shutdown (not a seam). */ + readonly close: () => Promise; +} + +/** + * Build the Cloudflare MCP serving seams over the long-lived D1 handle. Returns + * the three seam Layers plus the `close()` lifetime hook (no-op on Workers, + * where the isolate is torn down wholesale, but kept for parity with self-host). + */ +export const makeCloudflareMcpSeams = ( + config: CloudflareConfig, + dbHandle: ExecutorDbHandle, +): CloudflareMcpSeams => { + const sessionStore = makeCloudflareMcpSessionStore(config, dbHandle); + return { + auth: cloudflareAccessMcpAuth(config), + sessions: cloudflareMcpSessions(sessionStore), + reporter: cloudflareMcpReporter, + close: sessionStore.close, + }; +}; diff --git a/apps/host-cloudflare/src/mcp/session-store.ts b/apps/host-cloudflare/src/mcp/session-store.ts new file mode 100644 index 000000000..ab8c364ed --- /dev/null +++ b/apps/host-cloudflare/src/mcp/session-store.ts @@ -0,0 +1,75 @@ +import { Effect, Layer } from "effect"; +import type { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js"; + +import { ErrorCapture } from "@executor-js/api"; +import { type ExecutorDbHandle } from "@executor-js/api/server"; +import { McpErrorReporter, type Principal } from "@executor-js/host-mcp"; +import { + inMemoryMcpSessionsLayer, + makeInMemoryMcpSessionStore, + McpEngineBuildError, + type InMemoryMcpSessionStore, +} from "@executor-js/host-mcp/in-memory-session-store"; +import { createExecutorMcpServer } from "@executor-js/host-mcp/tool-server"; + +import type { CloudflareConfig } from "../config"; +import { makeCloudflareExecutionStackLayer, makeExecutionStack } from "../execution"; +import { ErrorCaptureLive } from "../observability"; + +// --------------------------------------------------------------------------- +// Cloudflare McpSessionStore wiring — the shared in-process store +// (`@executor-js/host-mcp/in-memory-session-store`) over the QuickJS engine. +// +// Identical seam to self-host: the provider-neutral store body lives in +// host-mcp; the Cloudflare host supplies only the per-session `buildServer` (the +// QuickJS engine over the long-lived D1 handle) and the error reporter. The +// in-process store fits the single-Worker QuickJS model — one isolate owns the +// session. The cross-isolate variant is cloud's Durable Object store behind this +// same `McpSessionStore` seam; that's the v2 upgrade once sessions must survive +// isolate eviction (a DO bound to `env.MCP_SESSION`). +// --------------------------------------------------------------------------- + +/** + * Build the per-session `McpServer` for a principal: assemble the scoped QuickJS + * engine over the long-lived D1 handle (the shared `makeExecutionStack` reading + * the Cloudflare execution-stack seams) and hand it to `createExecutorMcpServer`. + */ +const makeBuildServer = + (config: CloudflareConfig, dbHandle: ExecutorDbHandle) => + (principal: Principal): Effect.Effect => + makeExecutionStack( + principal.accountId, + principal.organizationId, + principal.organizationName, + ).pipe( + Effect.map(({ engine }) => engine), + Effect.provide(makeCloudflareExecutionStackLayer(config, dbHandle)), + Effect.mapError((cause) => new McpEngineBuildError({ cause })), + Effect.flatMap((engine) => createExecutorMcpServer({ engine })), + ); + +/** Build the in-process MCP session store over the long-lived D1 handle. */ +export const makeCloudflareMcpSessionStore = ( + config: CloudflareConfig, + dbHandle: ExecutorDbHandle, +): InMemoryMcpSessionStore => makeInMemoryMcpSessionStore(makeBuildServer(config, dbHandle)); + +/** The `McpSessionStore` envelope seam over a freshly built in-process store. */ +export const cloudflareMcpSessions = inMemoryMcpSessionsLayer; + +// --------------------------------------------------------------------------- +// Cloudflare McpErrorReporter seam — routes an orchestration defect the MCP +// envelope is about to render as a JSON-RPC 500 through the host's console +// `ErrorCapture`, so the operator still sees it (the envelope otherwise swallows +// the cause into a Response). Mirrors self-host's reporter. +// --------------------------------------------------------------------------- + +export const cloudflareMcpReporter: Layer.Layer = Layer.effect( + McpErrorReporter, + Effect.gen(function* () { + const capture = yield* ErrorCapture; + return { + report: (cause) => Effect.asVoid(capture.captureException(cause)), + }; + }), +).pipe(Layer.provide(ErrorCaptureLive)); diff --git a/apps/host-cloudflare/src/observability.ts b/apps/host-cloudflare/src/observability.ts new file mode 100644 index 000000000..249eb5206 --- /dev/null +++ b/apps/host-cloudflare/src/observability.ts @@ -0,0 +1,7 @@ +// Cloudflare host `ErrorCapture` — the shared console implementation with a +// `cloudflare-` trace-id prefix. Worker stdout is routed to Logpush/the +// dashboard, so the squashed cause is grep-able by the opaque 500 traceId. + +import { consoleErrorCapture } from "@executor-js/api/server"; + +export const ErrorCaptureLive = consoleErrorCapture("cloudflare"); diff --git a/apps/host-cloudflare/src/plugins.ts b/apps/host-cloudflare/src/plugins.ts new file mode 100644 index 000000000..941c80795 --- /dev/null +++ b/apps/host-cloudflare/src/plugins.ts @@ -0,0 +1,25 @@ +import { openApiHttpPlugin } from "@executor-js/plugin-openapi/api"; +import { mcpHttpPlugin } from "@executor-js/plugin-mcp/api"; +import { graphqlHttpPlugin } from "@executor-js/plugin-graphql/api"; +import { encryptedSecretsPlugin } from "@executor-js/plugin-encrypted-secrets"; + +// --------------------------------------------------------------------------- +// The Cloudflare host's plugin list — the same protocol/provider plugins as +// self-host (no WorkOS Vault). Built as a factory because the encrypted-secrets +// master key arrives via `env` at request time (no process.env on a Worker), so +// the plugin set is constructed per app-build with the resolved key. The tuple +// SHAPE (which drives the API + table set) is independent of the key value. +// +// `dangerouslyAllowStdioMCP` is false: a multi-user instance must not let a user +// spawn arbitrary stdio MCP processes. +// --------------------------------------------------------------------------- + +export const makeCloudflarePlugins = (secretKey: string) => + [ + openApiHttpPlugin(), + mcpHttpPlugin({ dangerouslyAllowStdioMCP: false }), + graphqlHttpPlugin(), + encryptedSecretsPlugin({ key: secretKey }), + ] as const; + +export type CloudflarePlugins = ReturnType; diff --git a/apps/host-cloudflare/src/quickjs-engine.wasm b/apps/host-cloudflare/src/quickjs-engine.wasm new file mode 100644 index 0000000000000000000000000000000000000000..ee1a98f5a7a5c1bb10b68b7f2a9947e134bf9a58 GIT binary patch literal 518880 zcmb@P3A|lJm9MMz-skM;4m$%O6R^)Q>P3mf2@pZB+ zi2Y)6H6h@PGdNFe9Ed(`XF(!rixc8NJ8PULY-h!G;C=s9`<#1j5`4V=y>pXu_O4yE zYSpS$Ypq(fsmuCXj?`A5Aqv2JA|TBb|uqFKCW$yepN4Upop+bL5BxN{ZeX4fXBl1Cc-H22Hz8Vn+pn)F60;zN{AgW!c92X*kIzd^fY1p;KtUD;{_#eSf zLT)D{5aKN|@FD{tKsIXIP=nf;a;RG=JKxzZx^#)(?ElU!<@@hl#`hy#m+$}S62AYz z#e6@?z8`Jr|L8m^GcM(Oi!1nkjJr4AkG1@dbNA%>@doW;_fW29EoG}cy~Ofwj{ICS zHy6dvE}vPBIhVNfj4X90#MJKH-QDzk%lMx8SXRWjcWLS4W7fDhuhR0acTduZV~#4_ zF>&M4*!lQ=$wVG^CyVv2+x6v&y7EQdt&$>3(zWXyK+|+G^>_1ko$~RYoi`EZ6UR^b z6-QMQcReaO#&yYd{~|8_Y+@o`<|niJ_u{cQ_9vtXg_5#N)8v@kO_V3y>!^E_i_X8m zpWJn%Pc##0bV@gQu%C$6Ziq8?V!SBvaWN4;VB%rN#N|=h#zn=7xXe$uUwNa&6K5OaY;_zzuybsAH=kcP>5{*wPIHU8u}|XkqO7QWSuS!b{@Y*D_H};6 z+NEVW<(5~STGp;<&%e z=cz0H>c4l#m!8!h_Zzy4cm{yH^u8D6X(mX+}_$NgQ@P1bbEXrlc4d&EagyKd20x@ZZ+dgS7x z-j_yYJq=PA!p1$VT_?(GlXXHip595jNc9$-F z)M+QKUhRuTt4}=1J-XXP&C!efgC4W&v1LVz z>lDViSEp0eN4d#-**UJNc{)ZqD6P>rl)li)v}11@3yqN=x(dytPB6eUHE{GDa!6d7o@oKWA)Z3 zf~BG;rwQJdN#}&|dq&aXD2h7#kD>?Btifk8&yQYw^wH7L(UP%K?sL@fN3B}6IO=pJ zJDtwrPSlyKh98<4KAlb;0UcnSV>?maiB?fnv@(L4lk1j@Es4j*#+HmNratHjki~Za z)LoWGcL8qaE}gqXElUVNA3NftALyFTOBcN~<_P=H=>QCzYVycsQG;0Jqm?nB1M?>#;_K2EPr`f+{I z@xJ|z`$?D!?uXxC%Y?!OOg#KhZ=hUf-00VhI%JKy!hJH2?lBqV`LSHDTFI9Z`G1^# zIx8RrpFI4K+-XT@+3cCJaiRYqR}=xu(pEt@%d@h*I4;$6Ws3HU+R9J`6s%cXa1kv&6#i9 zjj>;^uRn9wXa2$Ny3B8I@5}r~_s-03a{rq7Gu>ML21>=Kb03K3Q-0a?( zNB^+d{qH<_)ModVJbLtI_vSqM$IWhk9?fia*W}Tb&F)Qk^q9@=jd}Fg&F&3(^tjFL z^?CI8&2C>FUA)=7E{|q6yMM`}t()Cz^XQVz?lpO|ZL@oI9{tm1_o_VFzS%u9kDjpE z-4aKaZg#KCqbF{LF3~^RceB~OJdf6Ib}!4LKilkHl1C5T>|UHl8#cQa<_q;qhXR~{59-X_{U76>fO}%S;`Q7-V`474` z=C{Nz&t9B8KYMoe)NC&MROhqlr_-C$o6_skXLMdzKBIhc`P<^B#rKPY#ixtwi))Hk z6|XE_TD+imR`Jy0i`nP1f6s2oK9_wqdt3aO?95`AGI}*@v@hk`HCS?|d-3A^SjfAbWpyp!162=KLA?E!`{fSL83vugvADS1l%^Ir3vtMPu%zo1OMfS7or`b=k|Hyuv-J1O<`(gHj z?EBgGvhQZ!$-bR^EBj{ljqG*FLH>U|`&#zZ>?_%Cvp;0N%l4(z~r5{XRpM5I*T>6>x>*+^3AM1Q4{dW4T^qc87(u3)D)9#rum-#@7|s7Vj(GTfC>Zx%gCZQ}MLyitLlcCyI|3A1j`le6+Z+ z_+aOS$w!KRD_)s?sQ6%UL-B#)K=HZav&CnMFBM-bUYGt$`i0{2#lIJ~6kjjCR(!Si zO7Z35+r_tvZx-JuzFT~!_+jyb;(NvJ@+sw9d3*84;t$2|i{BOhS=?6qrucR7tKyf% zFN&WRKP!Gx{73QQ;@09v#h&t6<>&HGr<>lV;vhpS6i_5FZ7nRR1pIcs8 zKD&H*`Lgn*<=fMLP2Z9JF#SRL{q(unbFwS5&vmZOKHGU#_RQ=V+0(Pjv%T48I+ta8 zvfbIIJ5SDTPyd*{AbVbRRraFnm+3FkpQk@df13Uz{g3p=>85)Gw{IC7h{siaxo#u8w+wV?1$*pKV*osLsxS9V= zmafdwiKAAoSTR1iqRKl321od;Sg~ly;^ixb3jeT+72OrfQh!+TFk!{fD3;P9=M%3xk%-xc&}BwTJT{cPbY-#iKgQru?5Njs@O6iV={6j zkOJIsSjgIQ)_8{=z2aWh`F8=F@H}zTcrstx*czJG(8Fz~XNG)cjp+HYWcXCAA|a-l z1C4tqi2J4s8;;FXe+?QtXPeg_a2t)=3>pkQMt)JmuE1{Brg5-r0r8-{a;2rJrHvaq zdW3|K;zV`9in93%y%O;MmD@DFY)EFB(j*!Zmq-0>iS*F2~z5XL>0#BuoIkzNxx!EgMLw?`u%*Z%v)(n2NFOOS9gsl2}J3M zR6@mQ^1+`ov>1ZRRo?(Fjps3q`0Cw&*)V=I9r7kPpn~rhZZ$YI_i9^DHTP2W zh6z_otSNEJH~Wllj%qvl)Gf{Sv&ai)Pp@^4Yy9j6-8J94EuccaxLLPF1F$L18((B& zKsgaz8y7mFktW5P})pv|0?94}LY^vy{|2JvpvPn^XJ87MIOE<{RD)8b(WHtsab) z%dFLlt<_O;x_D57X+V_c3?7e;uz#^cnruVjbcSPdSBCv$;D!O@%Pm(`Hus#z;+|pX zg2luFEUswtE=YW#B~F&j+5v!WvsM7Q8ua4}@;lv88ikkhtIMBbTNnU^UqX~74ehf(QigU6#(dQl6$ISusVrbqq41l(F; zuT=`Q#?9J|=~sBE2QTG!1o>5i z{G+6Pr6m?+bGHGf#LeA?tQI8JfGwZd=Dh>VpF4Ow3jfuXm_v1y5|@0<4Z-`7_Rzm3 zEs|N-G-CN#E26qlxS*E3^ZE7Yg@#qAY{(U=Jx|(51PN9 zM-z3^if1XwXIsJSj;Q>+!Q;^~ud&3mY|fac^1T8X&e(*qJaWsPe+?3yp#7{nyNq-MMk zw3hxu1-}-lnvjnvX)lh0G>D~nXuWI^Z^KQv4s3?P`$9H@#EkmnwDTCi$c#Uw-9c<# znPa<9T~L2PlVdr>W2ViMx?@K2pwolpIj`){)UC3kZc}ms3<+qb6i-N8!`*HOh$5`s zB^p@mCq<`VCUBcHZ#3$nXWhVpL5m_Ypku((uxWO28_eaSXl(N>|4;}+lV!QTzgw1) zuMh!4qWWD_zAGJ=)b*Brw#G@Eg+HbQ^%ecG^|$kxM9Z1JJLq}?Q8u;@6C~O)(Q&@h z$)F_&H(&X(t6t~F(s1{!yF!=Bijivu4k!T=&sLv`Nfq%R z!^aYEH^m&ab@Xyso2s|M{#iHEE9y?&nPMgo%{IF(X`*d2mh-$JhJ!;}@ z{mx83ZRb7wI>9_{7NLlTT_Bf&NRY*%Y;9SN-A>tw*!c*YsEE1NhH(vfx|05-Th&d` z{$OtGK_6*6oIx9)t@4BE@v-ZdtvwQ~5qE+5x{j*byeJSJYEsv&%YA(y4uPvv7+4}w zomRi5@<`O_%)?Z%p-Ri6U#w_Ou{n?ok(-1>fGjGb$5t;UcKH2)VnA8 zZc}51(I?HXZja9!@2C$g`KUIzI9rw*t+*-fi`FgY+0Q!3mNQp{9u^U%q6df4%O67* zEmZ+<(p3spUD1D@ocF^87u^SjrY>JC7Qw6|48kD=kx_%jSkca+Ws=%f&@h4l zty~7jHI)eB>g@PgcAKkc33_g0HtZs`COExnfQ-$~eAmqKvyKy6k zbsX?+J1%MFZgN|zrvRC$!s7CtWEv4qOwPFv18o7TA~VVr0cpS=)1!Pdy+v*G)kb>) z>JM01JFDlX5*qI0C@KFM3JtRM*`XZVWn})fuSC%u%XO6G+N>d>V8uOjbTX4R$7un|J#K z719!`P}NhVSCvYTmjrLi(KKHaZ7E6DHBt2&f4JX7{R#S-za;a1ljYv;tUW_ph}F@_ zvB0SdK8Ry}XIGqY&~54Gum)VJ{|{k=(X65_H`#Od%{7pU#3&KZmStU2JCTRz~pt7fXdf(ctwk*+MG^fqnsTyCx zp<{w4L99Xa7-`c_EN8YODD=Oi{-7==clTsV+0z3%>*PJxwOJ25dG7bOyC=2TG^}oS zyDb}@!rN|l7py6Ck;Q4-!-4Q4^%tay857qFz*}& zn?vjftWVeUs>^*ZGMl35hill}HEY7P`PGteZQbsg4tISlH{i|NZPdDYrH%Hc8**!i zH>q6*Mms1O7UbZ?ff*0Fhb2fi!}jK#e+4nElM)6gyg~;70`cXmulqXcw2dm&Dih+7 z*h1{`fAf6oBP|i1hv~2KMxR?zv+H`XU1>Tpn4cUFT z+cYe&bzB_)MD>^TMNvJ(z$0WqWvt&t)I~inPMK}G0x7R;Z>H&N$1?YI2kVOl$v&>T z=m}Xf#*fn7R2XgBf=LCaN@JTO`tjB-_vRvgGp+&US zuCtA+s;8thBrb!epQqz4l&dovK{nL_hUNzA(fZ5zQD@p`*U8|J1|vt6rKrV{r48CJ zQ$4_p_@1~!W6vfM!nsAIdNKv=XWJDKV{el1w zFh&G1F%G_PV=~CZf!uv2&p{D-0>1>%;?sAvsKK%2T4T=-!ra3W0hBs)U<58)2 zkcX{JX#6fA>}tHtc7Ft&7sexR8A{VKtKE!Y zP#$gtKG084E@~!b&|bsUv!HQE_L}&A1Oo4ZjiN9r2j2)oDYsbqVKI>-NkohhQAWmnF(OeX)51S# zFm|ynE~HR^i=@J4Zz~%ct!$>*c~*J+VV3xa8BSy8?e7PYGYleD8CkycrcK4#$OM~k zH$Q$GW3pP=?6MJDv1p)yijh%iPzDnex>pyKM+2_@sIX!3fdDhJ zNG>msWB6B?17#&+Uz9u1z84SViLb8h&O3j);(^P3q<~_&Qc#2QM22A$w8mD^+`6Py zwR5|Ie*yGlfBYn>j%j=8K++%N?8jDw)ey;eo`?IktV;UoU)7xk#qX;=7nkoVqRy^K zE$nI@(m|I7+w}I^&)D5#MXOFO8?eUQ+^*etXClK^&->$WY;S@R>#o=b6Z+X+DsCpr zAfcZteM|F{xt%B;1e4u8d2T0;2AX*O5SsB}>r#Vy6cI450Vu`JtdBlMVsXVq&$bB8|KjiT1V}5MGSZX>N8>W8?OJ{CsSlC!+Pc z+xG8}cW`n`^~44nSnyX zWLp@H0os``27sn*<#GMwUhB3$-affo8XlJDCp-HUMCEEp%iKKkJ9qRa*VlXdi$FQz zrmPoTxSvLjhq(dlw6lK{LVO9&7S&?{ycia~_Z52v8RA+%me!MXb>V(M)xf)A4`6{Z zL9Zlx`eQr$%OHwiOw@~cY@L^>UDu_Kxdu-CwkS2RX)e?y$r~^-(-tR4*mDeFzbE_F)FgP8SADBg2$3Tu?K0 zTxfuzx~dmnw7;IHmjP&^t^`O;6YexE3iU;_c_|qt>!YnECAX7B#)sQ|zD5VmdU{Cm zvs{116^snOm+H>AVh_4I(v7#9h{t|!PZGxO-6L-3YFNrUatKcvYva=2Ne*`oLIo=e zgS)xiNu9`BYqlfBv0}Q_6G^I3dbBd!paC_!(&`;@b}Btw9v|aOJU%{!vGK6|x~lb6 z?b!oTTukX}Ihg5JVwazc0Wlb9^AbwF!F7B0Fqkx+%kycHdpKXg3gvrO81|A{en;P* zzki2KVTIO6CI+iX7t;{9Uhq7v_q)koNAyy!Fr^WEH^s?uMl-|w_ZYNS0b(FdtH7%I*UsS*!gxOJ5ms1`F^Bh z#DYOt>gW5ier4936dlwh8NMBr<^6?{W_J;0?DBp z0&8e8lU^65Z$Lu-RUhe=r$|#yM=C7RUaVLp1{Br`PGzkd<5#KsvCWxKPw$HxCX0x~ z@@xew4GOhdsV#;fK92R+coY%{%a9b5wM?pmhLV3dYRtKedfmh}0_Yh$oomY9;l4+K z8afAMoPzz*WN?oGBn#Y#%9Ku>O9KB!&HrSP6GU@f=xK9e^}tXydha14MdEhGAQ)BO zZ>v#gi-@FPT7p^7&LFHlV-$KyTpwz~KN4x~#$85a!>I&%>p|HZhg(6kP8fSydokBV z$k(RSQR~hK?v>yLzjD`}5=*CrC|G0Fr!WD6W7Sok^KH+n!rB(8Fin=wP>RUkqj@Ro zFuq)6jW_qL_z4OI+XM5qJc0fW_F9ZZVBCkHLv+dv=9K_dzl~O6S(<_NkK%4)A4qK& zAxbcl#D@x7s=gOtFBt`7PljZh$*J`yl{m8Qsl)*)qsi<8Sz$slfiX9jmGZa9<1CYp zZvxha^uU`sZ(X_Sy4cV+GQ(pFCVO%lM>6=T`>Cg^N8?ZK1=@gC^%@)_BP5bHFRGT6 zPr`+7+)rOOu`RuLW<+q6tgLt%bePM9M^J}HxShdXPrx8iz|q`O_Sm8(%cAJot?iSKbH^2ynO}KrklSQr<&jGmPWlWQiDdV!n2i8qa~}6}~L2DP|-quCFC4 zYnyFoM_n^hCJzIBgPHc_i#j%p)Vjf+FcF_8T8xu(6MxR~nl+>O#khn#ESN|jkpV+r zOL1MI{pe5`_52Q&;xr+r8?_YIHE=w_ieTLYN(H%ja=d*05*u}p3j3mWR&K`|qM#`^ zKrnz`u#BgS6{7`P2KaqvOhPjUg3Q-0u*=1JPL7!llPl4RO->KrQMTnKnFJ4NXmKtL zvTwKj93bQfb!OM0ThfK@Ia7Qn3;Dreqd+QK?$fetyWV$a%4@M5`PQ}3xdWErbE%eH zTh!#ltM|4@J#5@YSgd8ph%qD0kN^76CBrzZ=Ekk0k$%C)-|w77e!oGup11XmJE%!T zX=pmSO3FH;TC2%6^fKA41;<0y1_{J8^+)NE71r7o^^lqgAxx|jHNJeEXV8T)467f6 zS(yC78xod}zi1WQ`Q*8;{OpO3p#`sb7Dfq{hsMO`{Fd!EX~c%Hr}6k)|yY5G(R@ zEjFj}g?;4phpMbOU+TIyc*ccY7|L)?>+5B ztXzd=!h*KWHG(1?I;bg7q>^&m)zQb#mfUys5 zF%45bhhpM_upPo$&_VO<7yvqS?GCKqmg;n|D8I~c8HV$MMx$S58so zs=tHJcga4*65Y{{NjfQF>`&qKio>e2qmIO&vY1ffr->iaM33z&H92z?ztLk%1Xdr%Uyj9${y{v|(c@|dK58}& zS;v4>h*ig=n4%!cwLCJyJtFi~ZBDZ0hA)tJbQO(k)rsZnBD3Qp4bOv`2=FaZcd|ec zT*42Lb*79usKurJv&y3N7O0L+p-*}dl81;VTbrks!V|)wByh-u`6fvNI0@8RYXd>l zc5FgnlK6Y_9}W~HWS)!8l>9(aRc}p@Nue+zNSF-jL*E0@ra9P=GjjbHQiw#&DcY(X zf@MCRkPh}QeZ5VKmQ>Q>h5aoT6QsxCj;6VWv1F_QS%r)E53l7@;wWL?hfq2`zPR5x ze*@Iu@=~j%@AY#+KiYE5j(+#QX-O>TAH2Lsdyf!AGbqoQ;w>4zCq-xKeyP4zOMbhC zKi#ddcp2T}a<83csWw+aeG~7boY1P4k=Oc&Rpdpz0h!u4;|V>{X8o>{A+R3Ct(^a*_)1-PnAeo`g^5KGe@=FkgF zjBl8Uq4}9AW;VLkU13XD6gibk=y&^SjeGT=63Wv25Wf1nFE1L-)L6TLi~50|v>8SH zlvLmH?Mw}gZD?wFU*lG@Fl1HFrf~@o8E8(1CL^R=SzasgLtis8OyQ(*P^!7nzF@6x zt)9lf#)X7(xAf|7`iFQXFkIo7q~*!#^@=|eS|ll^)QWWmU|Mmx&IVg}WDI+lzvE#n zS^`2%=~T;rWYU6i&^1KkB;_MT%R}Z@7J&%2Ncs$FkE$|EiG<8jpV=XfY{dJq zw0v^}8sU$jALE)E+|K_(kuSI{6S*5$7v{!_ng^KuRV@u_sJZ{b+j}p(UAyr1_=UH3 zU3lADczevk+ZFS-tg(BHzqSDZ&lo(_QO$?gmS*dF&4+bmY5%4xc+NL{g#)Y0+l3tj zm^9vOb?>%4)qFMfjQFypn&bOAl8eb#D=edLlGcN8aOWOu=WBiB+bE8Kc^7obI@2k# z$slyF#A4&}Pwl)Y#MKHJ8*cd9Vq>rc{x&R2)TfMr$5Q~*3I9?9s&~d_fX{1wGi63< zk?kRSj|Rtze&P9mCk2M_cu@eygb5z@$#l#Rtm8ItOu++SjCdk?2k|?c-$-s~cOEp6 z@LGhJDgUh1jm*vfA{L}VIU@QUBb$noT|XkLt?g-wiG@{nwghM2KY|7Fe=cellA5^# z$*d4MXRDZ5W(GG~5Vv#u@^x0{95;*P!fXIvWiaX1W{~B8IwaGsOR#e4X!};lv+|$X z)jPcZLK6pnj0;{)I{mO{(Dour87ThNvSwAI-{CoMw5*^KnmXYz4_!VfFR~KlHl`VE zF~Qu6E5eoMQ)@I$iw`*IIQ7}|%>KQ-XuS*GXmb~X&;EXb1D|YAa6c}6@T!x&Qe*H^ z@J$n5n3a!o(KG;&CTE(;p@*+A4>K2o_{Kg$Mp7LOfU@OAnSG7z-aP#t%?qCHo2%a7 zn;(3|Rj@|$-hc6y_LBLuyM~?~?ivLO<{Fb&*!pt`S2odn1dzcp$kzGrH^|$PAo7=X~`pe?-we8a_NPy7$L@oN^Y4Nk#6@TiM!SfknNb z4u3dlrWPOGif()0?zI1He_X!F6O|;=vVT=d0)HqbPP40l2zC6BRY(F-$FK>=L%a`c zjg5c>j3r8(vkcNa+7(YXgCS=9LJVCm=0CGwz~ndzjN=)_Hl5YfN-9o<2GJSzkXl9_ zG9qA4c^M5AuFqbjIjDMv>BRH9ce;&l_vJ^bXbi`Du=9#FEw=^vW_rIm0X-{s)w(BYzsl&<<&G@di$3-!1*O2A3!{(-dtd#B8D1FQjihdboE%`MqW zb7xx#=);qQYJUf_vz=UpoBY-Fi}kW?z2{j+OnmVHI+zv#&pH_Z{8SJ3yBzYkimI zAr{aAc~SksYloglHwG%B`7X7}#mK~ex$3!^SWyY_`wo3=CHf$)QZUc;Y%WzLiFtuD z%^qw4!K$uj8T%k@y8~zoWj2jt4v~bN#j{jtI0Qr6ESoa*OKX2Q@Exn(XaftYstL_( zOak)=hn6dtoEdktpabB3WN?NaPr*r8`&~8(Nu%p7!WSE zmK+JVT63gykr|DKvo{beo|X8|43BkEB5gmg^?~4J28EIDpqt&Q9o|S0qyFE*BC^X0 zP1VNg90xNyQP{^)=Xkjo0a4hw%%qA{a53G~d0Z`)5kSXRAArX^esR=rFQpb3jy!AX zahWSH&>_QafkX!Y8LGRAGHEliZzTw#sC6-68@;OAdY0HSyd<>n0wUtVrFINwObz5^ z^wlf7eF_F^Ui(pCjj(3OGudk0=GDhmFHulC8z%`?pBGQfAifu(w(-4yB7%z(g=G1Y zs7Y>wZ!&l)vfb;CyJ8=ZpkM2gvS9BWEX^xfM(#cZAZ4N_zqnZVT)K&8%v$_Do^Z)f zXfI9wgQdwoq58oVRd_kjp1s-1)NQ`eK7n)yW|P99OS;WFP7m$l5&eM`(z2$4dXaoB z%M2x-ugCYp4c+S3B8qJ;kdQ#LNTF4)=#pyd7S_%M!(YQXBFIt0PGgJ#PM3>unldmr zCYi=KTxQXnhoEw(5H@bmP<~2+1YivN1;Dz^Cw}Zg+bm{qUhKfkRIlx0wz?BKV;IIf z+G5LSTNEUXQbZBr&}^_5qXCqAIg}f14AG-OGq6IA+8LuC zLkq+j>$Es_`fPO|9*@OO+SxD=kbk;5Jb7l_Af>`qvLV=kAU4QQHJaTj_)#z&hS{p7 zGuvlweaS##fXb|x%(5f(!$iK@T=T1z`fTE4xJhWpHmp;d64#zG?YgVxzY4n4itGH6 zvb;Y7M@51Ut#wrFWo;$|>jg(e9OQ4Xz2pL7GGLy40Ls(_S7Tln)Y&shX}J)mHFG-D zZBhM=%@HHHA@0yQ3uL)wXToX^rZ7w85)AFIwit=l@vpdU`li#=u%{@~8A`6wMrYjo ztlxa>xH?)Td5jvoLBNle(I<1)D3+AVc%;@$VYY>-DDvr|^2tQ&avj5#1?U_Q1n2qd{s0tyWWR-k55QGp+(dIM9T~uAo0=8usozgzo+2^)hJsh%d zd$dFCMid%sOkWE*Wvc^yR}cs*j}}QXQs_3}BQb|_D3KSM(;D7Juh8#{>*Stn&SQec zbK8%y0J-Z+JqmOA4lQEp87Sk*kLI{36B(sHC5o}D)i1M1WmYnO2qtCi&zCoD^g(|# z;As#8dw{jM3+v*1i#Uu4QL1wzK?p>AQa?D6xFg?1#8QcV;qHP}61AOr6e^GgIY8yG zFh=wOJ|p>~&RlG=L6j!^p|qJysmGX9X=~0hGelFh0MZ0yb^Irh@>=R11-S zJs&9i{AIa5-iv5GotQ-Hbqvluz|56gDA~wOq`e#f@m>@sn|v*>nBNdO$K-9j>-qI| zW=&V2mr%Bu12JMYL5rX|k=i2VsPYuR^RrH0)A~A7y|I5!*&A@BP(ZFyo%XoE`I_ER zMa=(1WV;M-r8-qRr}HPFZlTSStb_JHi6}xFB{3K%;E;`7lXNOdZ&rp`b*6#U8mZ!rCl}{t8LDu|Wa& zRGh}4O(8BZ=*}s39S_VIPI$mv+oIA>xH5Q$>@UOb>LR-2+WMk5XZk>kgk4qPtOe~y80`I)-J~E3 z1>g;WEC|T~7!U9(ay1&Upvnfb7*=hd$Rf@tVBl7Z<(?b~CqnzEXjJ_LojX!W(s^9# z8&>0};Y}{vFdnLBj{hTQ!HWhtBGR6!-bLxR%yNZaVR>$~Iy68lDQrg}k%B&1?cHi9WXJlE%G)yeV ztdn&{<{&gXKn_(>o&^qBZ^Q{K%qf+PDGqqV#Yy18FZHu22czsm+zDl-Gu+)MffAxN z$vqWatM~$-ae1H(vwP=Y2QsLV)!f&sfXM3AwUP>9$s(+CLbeGy$_BkwTa|ITI$RO8!&iG#>!$8&U#g`Df_SYf z7`X#vDVlVZdXkVq^6|2E`@# zcAUY=?YP%X$tzw+vDU^JtC4#k6BaZ@4Vo=>dP~%2v6rwGc?E3Ev+5BKHoCk7tJxVQ zEEZSqw2grPat+&5eGPY1ujy(uBa5}ZXA7bgsUM7u&gS%?7(lc_Zs87;rFjxB@V>@I z_3AE?-#k51ib4)j)@ojpZNcaJrPl;U(bZ=(pI>P%Uj{9V6^`>et$YqENZPDI(o}S- zSC}HZbZ>?28-I=hWqP36TzM1TfLrObzyZupuC!4m=I7@5j0^VLNiezQqq}A86Puut z@XPV>93$Qs)9hwkN=|}}lc>n9`p zB3c}V%DQ%&s2mpH6Mpd2odieO&y*N&wl~R7HQQTc@(a#_qdL)a_=BsM9Kp9J8yX1- zll}zFL8>g$owM=dIk8M~bE5i>sGoDx2(Cn1Gi1g+%ruPR)4IQfrDf_3U_gsQ;`!8m z)kQ=f{7rNd~I zX%nPom;mCW)%pWmh9ifr(kx@Fg)50qMq3DKGXR1)B&xq3HY>N&gDcslw5vWEC&eJF zS-mv`q~=L!4K)@=!Pvk`bSR9LYPCp`HYd#RHARH=KxNh4MXTI6Jk!hRhFr{yOUcs+ z(K?5CeH^)n251N@XfMiJKTSdu%1wws8WNgi{{^jK#RIhuwi+0EQa!w}QZ~n!FlcoF zm2F&g>O~uH!MROaAtjU+EyET~N=hyXqiUN~(qR42WOk*DvjumCO)QHUC#xh6?$uXV zhiaQIW4$V+Be{8$u^jjo^%%lw5`pG>OGRzkoz+LdfDZ*i)bihwBk*5;JaFKW1sn)B ztlr*RX45+3o+W{MY*#-G>){W_{cgKQjE@R7c3BFjXk&?*X1q0ChesrfqDwdzq^zrf zxU83HgmLJNA~7a<1&tW*Nk|^bgfv0sOg|3{2x9pt3nI6ms46vkqk}XD$qrNy>9F;& zLd66|3>$(ZX%N{t83P&sBkAWYI|QFT8t+95*mZJlAs@uFV^`|LW+e>K9}OmCWn}f zNu_>@aPAe{5w<)}N|TlK;!PMcxNDc1N1CnFP1bxEuCAU5qJS4r9I*U=0}4p1DVPo! z!vBWjZE^28r!~*~dRXs!K}dP-e9A9E%JYUP&*qp@S#k%NZ6^T2SUV~D>w%2Oec#%Lpi{-K=3D7Q|g+|~(ie zkPJE}#w%e=PBH|A;(@f&g@z-|n%_cHd@F-MDbhOCZd|5aJ2Ou3*~a+)8UE$K?@G zQ!;m$lt?zFO}wSLDq;nIr(^mO5A#zgVoQ0(EH{Z0m z1Eh!`rq|UC77^EBO)_|W%z`mdC0nTPtG%&wlU(1d+MAFSc1pnT@;LM?GRYi%=$oEd zo?2FfGh2*8KQn?D5K8AiLy+&DkEdY=1&7ES8OudF#cS4FY#t&Zz`^m? z{3oW<&si^j<5=^XQ_XaGTbuHVVan^T40)~`rhMSlA?4Y_ltG?7ho$_X96%oA`Sl?=k+Fsov=#2CH?QUSGWfJDm!NFbbQm&G%_R=64ccbsVK3oOwnE>+??Q^Dhe) z_+6OXMANib${}pR<1`!@%ACVzL$YS3O}BK7UpbijEYZGtHUd$jCRytiS;BWCOK9Nh zI$=u4DAI&lI|kDLoV~nup@lLAc_7<5?5B`iU$9D3Lx_d5wfrBj0@`5U184Za1R;Qp zD^}A{aT-8V(KDDm=#I#usbFfN;3bF{XpKact8PvhhX5YBy|3Wi6*~tNP+i1$Z7D!w za0{quQS*4t{fnmc$4#XbUpk%hrub63+SvucJ65*700*7Oxb6Zo!iSB;1qLcCnJ?48 z*tn|sD1=>AJun3DNHoYvhST~CR1Xr*wqCTb=AGnfu$(J{2N$BBZ43bWYC6X+&faQ6#^o&fwt$h$zissO^01=n}QKI%EYPMRLJTmO)Hk}BEa=(-n zA)7CWMxsB0IZP&kQpW;_o9FLAaX33Jn%#*#I#YkmRhC@GA^@7hJS~KOX`8WGf*hiS zrPJ)$)6st*G&ntQz&t?<*lG}kmSby@xdp+=KALo+1*8^i-b9|IoEbrUd9!pTXee=W(k8t%U5(Fs}&z++TU(MJLt+6MhYjE38enOH>3rzbasxZeS> zHXM;US{3sI?GT~&MjIssU>kzo6%U-O+GKW3WXHXl71zhVIw#wPQFk&|vCmgmmn3;I>Azlf`tP4%{r3oLGa)iF4h zA*6((Sx&t0fx#7Ye?L2yKEZ^ErW<;VQ#7D%w8hRX+&24YVT!T{SV`y)u(Cc}fR%s3 ztoDuB%!rXDnF#M2UfA_5E?gmiK~!yJHq3%=Fy_FT0Vcv{Fl08byjm^CUa(y>-t$Q6 zi(?~N^+k`;N{Smhn)*TpsDACQY|$_YO@9V#B+;GV+BDphr)t)FFoG4>FEyzuA3e}k z>ISS=(=D6<)k>gfS~S&B)nLrkQXPRnr$CxECruPCu{LH7&# z*0(n%a3ymHMXPQF@65s{2d1`6X^5+8&D4&}9FiZG_4?Y=Q<&Q3%EOS*2$CSP`-P@< zu2oUZ%&y;cwq+x{TXr52wj}}HHix2@v&NbXbGQ1w+uTi@hQ4<}-=pV(zR!>y`lFLt zJ#P%Gu5vva*ZjZ>E65PEc-Ct1Sfz|Zu{B`}6tL`MFVCA+y(teRfq`vEvdEF3r|4(2 zycD}pgb5x3eHC>eBTegTy_~d;^awCG!L!c9&rk*)C*XiCqhm&Ux`zg|j*O>AyAtj> zt4Dq6(a@Qw0}c%}(P7gdALw3cYlK|%vg2$D0}*IbYxgh5n-pAsp~JBg4()I)X%0Gk zq5UgQw(Q>s+z1e=+YUEzJJR8H-*$Ks=2jL4*$(-Rgj6sddoF@?L~+#bd8P^&pt5=f z!xHV)%ENXH2YJrofC(39yHL15<%s{taB2&diAEX&QQWAJC*NVWoy_zjTq?STutI`d zn)9@CpuUL{nOP?!wBQJ>iAL{=*>DZg^LY%jom+b*O|zJGa#-KW4l$i>_%=lCSL zB`XU7oH2g!Z1aUT-txxIB|_k*m$y@>1A~jXy6kJ~Qv>g@_BqQ4?Vd}-^R-q(ze8nj z50|*fSrf0bbD?T})>cB`qv-}XYaKIt2`!Be{SBI^vLCv<({pqwlEYz(sedRQH2ln2 zcF?W3#P|xg#Cur=*TJY75%?@a#b#_mMlCyfBsc`^V3EM*vrM*S)PZq4z*yvIF=m8G zBzMkboTOl^ysCmhr0`0d0azJZG*&Fxcnh!yxf!jsL^fW8j!aIXtrD{b@Pi~}+XLnf zOSTA`Xv=Ir0(!{LD!&{7a7^%DbFdDxcTt`H(4sNXj$RuyIW!)Vngd$_c5aBHm%&Kg zQ#0p|V;s<|wrOgZX3EXG4O;EQYh2sJR{auY+B(l<*ae|^lE5^O_hD!z!DS%6niM=P zeJ9d_fub6fW(+Qy(ls|ygA}1)T5_Wqf!=x2yq=4|p1QlaWv`f?56WNKm9b|wfGI=Y zyjw|jO%Kx^1-&wL(U3{B#K1fcsw#F0&Qw0NN*utjv5dB~z&Y6rU(g9r%z1Z=7RA)4<4vCqyk?{l zztmz6dr*xQ90p#&p}|G!z<@;wkU{1ajz{`M_9rQ3Zkd^<9?#zzxg?d>7M<)7B(`k!7LII|<-UL&hpLj3R6cc+Wfp zm@o1WKnX;Nt#x;X9s=9q<>VoNqhu?Dfr23+4`J2sh>+$5;CL%I2d`cuZ$RAljBpDN z0V-0#njBg#dy`gRF_8t=Lc<%>m^Ioc)Hn!YXQ22{Sm$EbXdKHr_^+uxVl!39_oLT zh7IOKC?tJvg|GnHX$BsJL!Fk8E|5e91w`irG5LM%%x*caFpNosnWAaBC`>a+FlV7q zgBx2$WlAKc*3fTj+&%PE2k3YlfrC7e&%lAlq+`V6(N4_F=GI54 zE+0?VvPhW>$jpWrEk9#TW;pj|mrF|{1SAMW7?d044z^%`znWGKe9_`dqZs@XjGRNA zif-7Z5npt2WT#@lmewJ+<%_oV;foH9k}+xz2%A%7JkUw4Od5#eGp0|Z$R$q(5@R6h z2;U@ti00s@58aU7k+fiK`~Oi|gfS!EBI88eV9rGyY#f}6DN-XnqSSz_HoqH6jd|xH zw1$scsbNx#S6hv^7K7BVv1?KzJ(6FM&UL}jq?K!%(b=90^DEL}VTOU+(DXwq{jI@m zyl+y2ZeWQZNC^80PRzi=5|wlXKgbPni?Z@FAcfwLWY%&d&Sd+V7>HU%z0&X-LZ879 zy4KYS>Y~|DjP)Gm+Q(eMZIlgal-WCRX~IUw6PTL5Bi@Sd z9B*k22qgJYh=>ssojc?$tElCz7~UcV=Exe!%C1)UzZCUw&<2eJfuX}dFN)&$p<7iX z(~p{|a=Drw-=Rh_aWeEPptBjD(nvrK8cA~=@fHs2!R%e_Qs_Two?Li&^r6D#+49IKRr zlj+^|Fto66u-ksF+@;qH^N@P06NfvB?HREV2J^k~AhKm2ik1dQl!P^e>XC!8+Gha_ z0-MQU!e)@8w3m|%<0pcWkf;^qzRwB@x*C7(2R!A>86FI|@E#hSH2}e8;dO%tJ;M8G z#yOyuj4dKFVtr~pM{=<_4!H#uJjSAjJ}7wJTBc?Ere^-Vo%1M=4=TM%{j+)LkAXHBn1tFt?cu;2^@@8eTrdd&ar8~c`;h^nnn4%}zz>XvC!Zq?$ zbDlG$2gh9MWfIdcPc0t;r}>&hX|A~0HE;VYbJxE3ig;|rA!tF1mcRT4x~IC2+GIq1 z>!EumExst8j@rK_t)nBy7dfI6y@Boj&_YXA~ApUE_##CZrzXgl1kmgZwIQ=?a}y{u zUH&hK*y@IS7YtracY!&P38rcjL^XA>mNP_`Gq4SG*dnr)_pS_rszQ$#g*oDzRLK=Z z53%36Izb4Sb_wgdv6>$Qd#8F8h$rQTJtt`m!nHbU0$mTX;vEHk@QgibN29Y5>+1PK z8Vvc+v8ZxR$ASJ(5RGaS4?9lP?jPz)4G%+Z!Adk1Da5~TUrNmY@`A+LUQnz;A81Po zX)Z$(?1CXBn?ZJlu|*PORmlJOq`bltH$(%(DQsn)C7xEN&o*^0jn&IEN;5`l&x$iW^a|#Du>$NS{kw`a8z>AZjX5T zZh0*HX)SBptt}T|u#e_kP6TZoPO(x=jGHEbP|x*P8L0m1C%D$iw|7G5_LVpx=^Ywu z2S~!Thkn}He49pl2+RYy%rWTZ;2Y=_N zVI>u?lA}$?PBVS*2dP`XIS)8A+>@eHqs6?gzfyWYdLiZG=)V%MS0sg9v z{OLLw!_IVrz;=54%I3e*=nuJyH$QMqBDZU+3s;q5*Xk(b3hiNKu2e?Z6(P44o)m!A z6tFSrhz=;WiDc;(krs}Hf7$PB!%vd&7CiKj>PnsThFGH9st|nOksP!Xqn1e-6w0bs zMCJ3k3VjBu#l{ZUYyOuO@Ve)&=M%wC6ciX&y-?@!aVazB0Cqz4hnTfpI|PQ5YhiGl zQ_(btNdB2amh^4h>t(FWaB#M(?6quM(}Xrw03guTy2r^JvoN2r=BFG>RFQ7|DoaZV z>ox%;f)h5ecwss-fDyQ#vUyKShRxLC*yr>jC8tc^^04|$ z`;rk<7mQ`93&q7GQ`JbPaj`}_3|YI7@j<|CsH1vOY-f}K<7K>^M4%PBBbb|Yd**nT z`lIG1#)3gPQ)6<101i#|jx>F5nrr8%DV2o2j}o`JZD;1kVELTkB1$El7ti2l-0 z&BuNg8ZSK^qR}n;4xO&W_)xqMjz1(Xb05}mqG^$3Si5$gA^?RWR|HN0oeS2fs@Hbp zNpFXqqJ)SP_;skurj`Ji3T-kn+LmV8Hz=$}uDP}Cn$YB00-kbE^lYw-Db$Nh@2piX zidhGP+4cToN~=$P3lpH;;2EZ%Y-{BG%<2X*gswKpy%C)uuHsdUFN_2Ajpi+h`@j-I z?a+beNDqXDc@O}SlyCD43Zn{nrZr{1O0Oym#?e$Xr&rI!Og<5g2)d8h>O{BsB;86s zXyxZB3t&2lw;XUA z?rn9RwGVkmti7!Tf!TZdHgMq%F^l5&Ol2tNDe{`%4@~%x6-AQNN9d^mNHKOa%~N?~ zLMGyA*gvdnqkpwOf&P;pilxqp|K-NpPdDjw;=#@QZ+AQz&&J0+DaH8Mcv?;lK5d@t z4nN9}jo;zpj9sQQg+ovWlNTLuhImJ&k1Z~nyQ{~hqH{KkS6rL%#So-p2%$+KcQRAG z7L%wN)6w=y(%48`Amq11kxn$jfJaw_jj#q2jXRRVY$~N=ot=o9Ax4HDg9l%o zXx{YZ9-FKtd=cJwNT5aZ@Tbh8Yq4b_!A6(Xh$#XKau5=@si`b-H&@)t5EiBYC3^7Ez=$mxlz=*-gkwX$v5G2 z9^1{1SdWx2g0LsKvU9e1{Q=mVaeRb&hopqxkV+oy9`Pf~PvZh+maDFDJ;o}Oadn*4x*4msMs-iWM=1VtfnvMRJ z7*O+sq#`b{gt$M404oUPHsN}yo*wnXp$rSAGAOT;W1%-^=wTG3%^NkMP$gpWVO+21 zP20q9>SgRW+%430rI*`itK2HoxD@sch=d7gM3)^hkC1XRRI5`Doo?ebz|6aIj;{7C zC3Unuyhj32KDpjiPZEA?Ecr7a88!Y3!I0=lZ7wVS680N9%#hKN3)&n?1v@qHnQc;q zya)Zr8i{(X{)*U3*SxN#TkfMW>m6Qjop7Py-Ol>%G4w5kFiTr;3+V2pyQ(iG!`EId z3hkg@DbBlKlJb_Zfs)|7fn2_k!~TL&=7l|1@J2={xk2` zk@NI7Ewq^1sCnO)UG+LI*)yMZ-CnOW%{~|vA4_zWAgsqh3fO%dU5bPeOa`hs=N0(U zV+Xf3i{SAdeYsPYJS_i7*V@kS!ONXEY17ss2PbYGN9-L{z=$vxu55;@9&u^{#6EzS z(T|g9%7^VF~={u!8O0;tv!xG^__1x zOS@_$O)CbC0yUe6iOz_I=!QOq5YNMV*u(A7f-<09#zWufdid}-)$ z0+$frK+p=uhxL5UDN+6Q-Az{eZbM?-!*oc2TCX0Ye)84E-YNhtW-N297aSQp&0}oR zw+YoH>d}M%DttFETlEx?lF6}1Nv8~m$sv16G=iPLELyoFPeHcfg-dkuof#K_9mD7l z1^?ehM-fJcz0i!qb;medmtGy?R9AIb7%Xa{oU>ic`s^^)1$;iHslSMY%|z{ip?TAs z-WsF>0|sx&2x6l8Riw@58S;=KL3VVSSKe2LVH%OLz`0?g=6sGDerYE*S{A>Lx4lzd z{B1utLK&=VbD$Fj!~n`Fr|woO?7gn|5C4Nn`hjKL(F`Au%C&N$WFR)n=VI?FBugRBnnj-xCvhN|~4e++MWv5Z&yzP3#)P`h$?O2&ZC zK*n1yYoT%-`WuhmpSK!ZujGSNVm(br*^RD&98R^+s|>YuIHs56FATzAY*FI+2oc3m zNn1td*}k6ImlqFx_{?Q$%sI)n!F<9Fu(oMMlWWiB(PuX(({0Tw#9|z0;|G>17|RVU z%dPtB>IZZ!b;x9s$dn0US`}=zl;7m-4nwbSmpc7*9GowX;gjx`7oT&iIxL&4*NcQ> zdm$@3S4}@g>l4n0Q$O71cF34rf7)J=E2IO(4-)CKNH1GAW zt(ZKDA4wvdSGW`I%@J|UGj3x{ZP^bHZRfS8(p{HPCkca7usZDn%I?|?GCB<|;ShgC zD5;_4em`nGM4~8k*VNT>VGY%GRXRH?Mp!Q?R^tSnWrJy;gj2}Ma-8HacbRF+;mO(1 zHpLbzSQ1V>STv z<+SDg$*RImg_kincHQXXk%t%d#N6s`^0bzu0dl)Xa|N+Cw19Qi{3W5;Sga-#IjCqe zDLA2hJ$?aKD4tHUU9(w+M6;R$&@c_IV&Ts2&BErcQ~lg)KtgWNjH?xtB74R`Y)rJO z6(U!sd4idCoKT=(PcuW&Bb=Kw-{nSzcp~n42Z1m?cqgH8JTJIpT0<3D3JNLm`s=P2 zhkKBv7L}1lAv}TCLSu6vgT&?ApmEnsZ%L|9Xn@Nho9>^)NP@SnoI+F;vSGFSt_>tcB$P}@a&J#jF zs3n3ORafDr2qHo$Ah_DB1rTkn|2R3T=P0Wjf~(67L*W*d-4((s@xW`|qz|?cAjL8f zH6fpT_0kkIAzi?evN~m;49d4^`AOX#O#^sZF$aC74Y(&cgbMtz$Hwg;iF3TweWpK# zlwrB;Bdh@>NfddeYgzLFbJX!`uFI@>uQ^=D@ICg?y=GaR=sL`B^5%hZ+~m#A%`cdn z?;3XJ-Es2M>tsFGy#F_9D{G)=(6LZXpn7@Zd*fo3m>*anZLZs83ch*S@8(OS&5wAk zUf5L#uZ=$V+u7#JVG7h-fA3)xR5((6z9uRDwC3CVubliZ|Em$B8zhEZx1{iK9M;Z6 z3^h^2kS!UA!I4(gG|*ggot-wxs^hUnaGhw#(5_e^(nV3Ns?{)G{qxG^G@ZZJoK`I{ z+o-uA_mpTuS1{lo;7bKWYzr zFlZ6oYn`jkjPDSC4I{(fE)K;%R3{ul?ev~ryt5QY zcpZroU^MErZ?ZwPWw=mR#07q^ zfB*)_an`Zb3Y!sLq-Up4?0+%n zHfb;vtY8BbcaRu~f-o`iT>cM&MwUv8+nSi7PYEp56M`6c4^cbdQWHO<+A!XTA{)U= zvQ&>SUg5>Bn|Z@;(B4{qZ>h8yqR`@H`@?7e%uT~&4W zz1G^-bN1fntdk1~IRVz*fH^=y4hkW1DQ6+MK#-f1QtQ)VtJdaFBxy`-g(Q%Omg1$Y z)=Tvf6^*r^ctOA$q2iq?idL=mZPd2fkFC`{Ua(bpzrQi&+I#Jj6G+4 z^D^cbV~#QAm}8Eqm(D@`2G8DrSy>^#f-T6ry~)KS?Mq@=xL6g-lW$A)M^1A??%> zuriWr&JL7^+Fb1jv&e7OBFUNvew0 zCZyiQ76Ho6i8)BI;h3vRplO9GgJGmme!bRLPA8~%BtfMIZ zxA*Wv7P7l8VBfAr>kgizwS+SK(hRXI*P8N4dR%J_)U!8ujxJVowfz{~p6`2CWpnyw zyKRa8M^WI@9oB0ZOml8lJ)4|#B%-_YcX(>S}}dz>~Y1241n93 zz9Z&dM{?NABr}EI&39RPmejb)9xozjnFmMJw&}+EmCE2uG<06&Y_WtltHDEhMtdkJ+AnSUblQ z#hAXG-Bo6V1g)mG7fYX|hZUB;dhKYarW?ep_QU$$59Vt&aa%X`l2N~eMKKaunhNVE z7LK36m5Pw45FY^WFPDEXRPU;_N`B1d^dZ>69%kLJ^`iz3?VrMQk3qT->b3aD2$Q)| zZ8XQ4wfe|ttKFFx8%w>vX;NczNJy5T?`5RiozY(6FffV#qS0BLRZdF)p-mQGLB`Y9 zH9Ct7GE%mP&OL9;ojcd}uNMJr_+La7{BVCYM$$hI@!h!e5@!6cz>tHwiqT@^h!}Soajw0DYj4)wZ z$O{iIZ_l~s4o+l|j$2dT9zABu)~#norx+~MwUPcYk_94={aon$V{+k4+w-$Frw{9~ zu<=Q*5%{-C`0?rTj|a;?K3o3rb$)CNRlZXCzIO0<4_&KBojZ&3eRQ-sIt5L%tGQ*8 zFgsitS90Fm&S6a@dtwM}L3n!c413Xpb@?IZDMOvyoL;Prh6U(h5s((sF3o{NFe4U} zf(AdCt;o*e(s_T@;MsBZY;Aa=)8wa`n<+)Z(u5LN;V|N66n-(+EPXWAgtG3)*d*{z zcqf^{n&gr!T={pEZfK!nbe<%+$fFpxT1C3bvdS@|U;`10VaCF@&OI_t;l;mVQ0i+e z8P5Wb6#UxltguotvgwVH4X<`}n*t40u${kT#}>j##RQEl9wLUSFn5*@9`9KK7;+~^ z+6SN+(jmt*4MfKQf+1dj0F>guND*Sx!WI(FZy}eHIIa(fJ$L@m2o%$zrp}^I3vJ>1 zQiTsI7On@H%`OjoU7MAJ5LesG5O%<-A43GS;2VoBeQl!yuUklma-#>Jb=(Mzi~3$= z9;1cYR%+&V#hWJ4hq#bl@vxb9azOI@&-_=u#4e2H<`$%3LtY=S>VRn`BK?l?APyfl zzhBcZ-hi2wYIY-Lg#_Z;AhAxU+U5sc-~(9T`@&!+K?e(g%9@qr57;d5@0vFo#i|w+ zVp}M(5#V5YxI_^vmTAl0`^eR{V#(&AS^CYG8vN6xQq0vEDOrL-7P1$^!i(g*r1!V5sI-xV2%W&Q{A;^(wl8PgIRz+m3wMi`_ccY!lHt#^avrx*g zZUnO93?eX$DV{e-v5)3}xv~W2$`Y8<0ZhVy3>Q-efVt9fksOGNDcUTf!sKee_u5h) z#OE0*+5r^=BF;g@TA%nJgLipb;|Hsf{PN+8e<#YLlSCSH+{fKG{TSAWZ#pBooL`ag z<>{4;;fkjcb5htf@g>s43nYso<2KT+tm(D(rmsuj7g5G2Y(mQT&7@~63wt1x0MI+@ zaw=J~5^+0sI@shT^R$d-DF8~aGi^&Y;#PfTSfHMEF!4eza1PT1Afe1t0!ZxvNNrA8 z=txbAXhqXic)0pZtWzRk_;aVFGR~_Dj#s2_6`PA|)N{-k2H7aB4P?D{)P=fi^=NKS z%L??b+CT27q5KEz1z~G0*CLs)7de3cw6e^Amqp=b!u}}C-JmqagUYDpt&3?h&fj^A zELtCOC3m$vZew+!&v!QayETWSTUb@?gi%sc#Ijf3(Y)d)g(2GM>yTdBk3k+~Sw;7y zS$1e4KolxppR6o-b1g2Rf&cvad^-Xl zUjBy&Je_MHMm;?rccQ71J%sN<0bm$4;HN}N}`6#(c=gxhTB!({qxV3dVPRuz}#g!wk?4AO_y52)Qzv zk8c5e)NK&OsDnIJy2gbd$*I2c|5$C{HnC6;1^Fw!TvZ%LR=pa-RU6=D3quW#wre7C z50^;{+lZ>^Wz8&PdSJ$rTc%g@B?EBxmkE8)SRx86y-|oJ>Tz2ZZ?&4Vr0wd^iI|9C z$Wnpr@OLQ`gCMou$dC9uB1$nuGa~NA6Qg^1o7(vby@MY6Szp(4iNpV&5>m!)1-E4(*PKP!iQO zzk|f*C#)nrxJ)^v3;&SNk6kWO!ad(wmbCkq0Je^c`mBu0pceB%Uqv~BUMyiSGOqWcCn6+B zR@(@SkX0+}V&pS{vRpA&5bMI?%Ox7>g*3@b*!1sc;~t(LnXGbS)^>m#oGGgWlM3 z7(k2A>Z+(Iy2-q=9T>=OgXT$_)__efQ#Bm)NWWoNx<6c+Uuggts8aypk`W}$g$H&o zS6e%%b}D6UWvG#GWLVy?Fn%%e0d1{{E;mdiTwM${JNRSK6?>&vRz*j%kpV*Shv-13 z$i1=GWJ#%Sm*~&s*cEsMzqa)1EdthdHlZZZ3!agapl%>AhEI?NA&McZv#V^R=AFWd z3fZ&JK&ho`WtGCoIZ`#p0|UD<0e{oouN!+6e)V`o|0G`&ssV?s4?=-pJ=&~3m9)qr zn8b||_g3tl47DkpZpIvqi6}G%@7j0(T&IzQvo*=(d?3#+5t{jbh1S$ab;hO|f(%3iIBcAH!ykwkY&Z(svYQq>iPZDNIo1x;$6W zuIH+*jMf*h+r&{W6vG|-Wwoncx3{`+HhL=T9iJQD!~q3U1kLL${PB6Z#vTBp{0DYa z_bi!}BlL&@(UqKb-7&WkN|e=DBm4+6Vw_ADL1@_u9J4R*x+PB~UO?!UYGNH!A*GfW z2Udf|NLZByEegp-+2(ujN$a%84S$;CulTB+76FOcFM&%inm{IOV1d2{=F5H(nH^|g z!fQ}BqB}5vQEJo`)E6UnxH224p;nlOlHGJ{Vjd4N)Fd)u+xB8(P4BdYDkY$s(u8?y z51W>mKNzDK5Md1PKxHPU^I1kXdJT|nzj}lCDv(}V;NlZZ<*ViH@}|hW`FKOh>ZTlI zN@5UeL~4~Y8ko{zXdhc6jIEoru*b3S^AYBb6c?;&R~5+80Inqeam@9AP3;(}A+90I z+CUl8rt$D>gUb2V1Sd8US7vS{80) zCa)*k@+lK0PF+V;#Cl_kD#=J3D^o_3|J#4n8g_M(cNK+S*~FkZ=-p9#iHxEJCd&v= z&k(B|_matN29bx7o3>&@j{&iUGw*&a*ZMCfxF#QIskVe?i`5jS?f$sKj)t@`!QaNS zl1Ru3b6}|;8ZLc%+&f^6j&m5h{~u#-POE9>EXAFT7(r0xI+Dr-=nN%eZ`OK+5tqW3T3kV_(~{uZ*#pCn4MHn4!Joh3$(pbhN~<|*?0;Xp zMc2<@*CK=z!obI${E<)o2Va@w`#!D*XjCayW2Na~+mNPd zaiMud9n?y*NoFB|Y6<26O~*h5vNV}M-axJcx=k*Y5X$e1^AF+#A+FUW=0^#raxwEM z(56_9{A_*Z%j7Z{sC?S{jM7cBAHI{2o>uc zCvt~Xwm^@MEcEMHJje-Ee zAgp2>;NgBAsoM{LMHX1BY#ZsRK@qoAdc<#P>9GyS8f5#Z_$Rj?mNz$KGdNg;cvf84A0tkI{(JxEWqF;6ji+&B) z>BEWbP$@u-QY-c6RQ)+ifAC~RV3csbjwk@8EdmR0^ZQo-ls0ex#a?7vDY-#vi;96u zz{|?@5JlnO>-ao-1FD`18m7l&J8eP${!$Yp4g33fXJQ_S^q=IH;Pv7j_3h;zv~olV z9ZfN#Zsc*@!n-2z1J<$_)kiW5+(F-gXrfksJfl=ynV!a$k8SZ`;|%}|M+QWWe1RPp zV4|zSTwrs%Qq0Ot*ck$(jmpgrY(Bx2+n{RH#>c)rf$H-S)bv8tl&MH12?YL>Jrpz> z7SsQ%pgT2MF5l=M94X%FLl7M&k$ zJ+m6+EbE7mS_?0Q3{(24m7=8a z;Mo!_41JoZZvt>0F&QG8;Th(?z_(~xqMXg|G!4>FC7|rA4IZ$p_D)UjS95Sz&&Hr< z%zo{k^9SRJ&7p6{gLy!_pJB%4f^?b&r+%DS_@><&p8YJd$uE5eH1d;~GBHtySK&@P z2a0Hy09nH?zUYt^i5?ZZxB7Gzm38-TpPsbkhEPH?3W1d4XbY!#MuU$Et7TCw5pBRS z*uO^%LlrhS5X`+%V^Bb;=l{Gnc7K8nBqMyPmT8W(amEl;=?9*1?#Zkpiul2p8^zUv zpMhN)Mr~ua0Rvkh(MpZ3qoG2g83g>)#?BYNi`DN+J4$c$1zA2%2cn5dB~e4Vv@e^C z4NQrwrEBRDMm{7Tz!9!4omR)<=rdTMerzP3-zPB`1devl7C$~|x`GfTuN@Cw&jK+iPuPF&lZmuqF331sGl{v61-yjAak z6_k1rnp z8j*rof`ZLI@ptNciM`p+0>;4hcYufGskZLJ$)lBMSlRq(tXq(QQ(;QbNgL2CNh<EqWqI?&Z0_MB!tZZOdo)fXLg)|U`fua;1J}Y$(sSxGjCWVz&cca?~ zN+81f(PgvdzEZ#+$i!OJN9XO744FwsyT3oCFB#gpm3UPg4ab$ldRXpnvvxvtLO2a-Yez%uMs`VY0% zWGDp|-$FQvC~Qf46S!a_$!&>5=L*bylBf=BKVP-olNQ#2VkCAsA!sH29@e}%uB6{! z{{UgKptV8)?Q^QnSq@U}Nv&r(FwO$a>rB3nU#V*({p;?U;Y*iE-uq!#Mm~!oFu9*S z`hdV>a0h)FTXnbOsP&M(uez>vbIi#LaRgp#w#;Oa=>|^L7BC6N?L`DorfHp3X7gz_ zjGr&8fe9X@Z>f8pc1v|gBi2&-esCZvTXEFl~t8}z@@meng zLCiV!o(y9r9_TMJxc5S(_uD?R(3&aRV+F^JoxQ{zp%!<|y@H;wH{d8;LC;yiNzEel zCq8+7C8WQNWYF&9+)Mlpda&Y-))mGYT_v8wh=!C2tczE5A~Ik@BeZ|7F*m&M9A zrnuYTSB@61JP0sR+x?qreTG7~@4{LpOq}?G;%0)Lp1wFf09!VS8e7?B{-laBbdlo+ z*TWm{-uao_QRSdec`ItlcERkm7*a=rAE(ex2HvMw2gZO+K0uKbv>kl(W;p2zdjri9 z)a0M~QCXUK6EMcz&R+}cJepD%SHpqa#$fL|ndys;Vs2ca1h*t;uZxhw|FmIIQ*s!b z3`a-iZ0&np^{Y{@*J{-&=4`BN5(+qAZAlhitS6EM5a2Dp>c|!XNAv^!_54t#M|(|% zL{c1{0hQ&TG0$YejsUuS0zZ_6{@}8gY#~dIr7c!M9^GR`P^+CGjXLCp8IxK`+wIb?{Wldg5 z_;rs6LZQ0?j)~G&#H`{?{y5vh+A{2ID~u!>_@@ynq;=ysIkq?-GrgryxVtFhBkL{D zN~fMJAPfQj3$Bwj$+NOXc7z40qj)rzu1usjBf^t@Et7LB~4R0}kF9(64TS=wuMOv1eW3pSHgJOXLjFJpr$ zYfdbQx+`S2QR@ZSSb%qRe6m5?Yi-u&RFCvyIatdY8+)UZVq8r3?c7Ja8K`=TLwqFX zh-hd5nhF>Rr`4wFShi$MawQ*QI;+y-$A$iEBOlyXy;eO6QO#^|KE65sKG}n|%=VT* zh#DxVGjkRCz>d}=wzJuS7w~Pix0oM|Z1KewM+T9a*~EI=&Lg9{u&@NP5sVofrzIen zw0$>!Et@dF?Jn~2mB~EL*$= zC>So-q2J!bn&dnbUb7<5T2j>$2Z2aU!6Azv{aC>h(~y4*jU31y7-#}BS#3AFN-hKp zIe7&dmA)+Xc)7&JeAVvmDzp-@`p0I4itL^Y_-ubn@`16roDVJoJPOS7@Mu1Gcnlvr z%(8|0UBNGCixw|EV#$%qCYN`6 z#~yc7cJwhPtXOg4i6^c6`}oFW)yb=;zZReJ#3!A4+M3hXKKaRKoN?x@@mu1v&-$fT z#D5b1Y5dCgRq>z4|2uwT{O0&g?4i6meog$^_;vAL#BYt?7VnK;&%ZbD@0^+Z+^3v( z_3vJ@_4l5?ecSV{-SYc8uK&Xu;v3`L@h$O#@!!OsjXziV_ktI^;1Bl1H^ncBUlhMM zzB&G*_>be4#xIM%9)C6dJO15}+!?TDP@jK#o#&^f}#`nY@jz1FL7w?Nd8Gk&!KmP0Zqwxdr2XGXAF#b~fiTGob{;!xz zZv4MWwN`JeTfbrB`4?=u@TnJFe95JkJ?-*ezT#J|{MD!b+B5#wum8qX&-~5bde*a_ z^V`q;oz1h&UGdKAUibw5dno>V{Dt`8_{#|PW;S|SWa4QwuQ3S`F-+w~`#*Vy&^R^g zOht-Wm`~7^Q%b6(d7AmDbup6P9naq3GSpgs#Cx8OTn&!z*1J)yFZ%%e#EU#}PLWEf z2#I4IMp(vq zCa{cboJ0i6WYMwKao}rY<1#_&*+Kw}(@%1QW?kps)eO6qtjLv&EMK97pee=DO!tGS zq-05gp(uv{2bhvJ+(!(SjaV`I40xmvFLQ=F%p#gz0U0 zJZPUa8f}{hvTw1U@eq}p%^F3#ySoggmH4`t%QjWQhC!A-?XjoEzsBlEJfGfM?~NFd zN78!;27|aGZ232|0I265J6;}@`8Zf;Krr1|5Fku{y9CU4Ed+#Pxi15>R*{|nq@Y>JSv?{8VZw|NOvr;4}QD}}Jd93EXF<*1m*eC?; zt{`R(@MnAa<-|7~JEw=TOi`F!nFaU%_j*vjnX{n!ozvlC4e1}$VS$b=iA;P1;&vZ_ zSv_B|Qh~`ssS*l}#rr6*@t8n~+Gg(-pdHx!T-;%k&B2|cr~S7Ez?2U$v{M>zAM1ez zz;-}82IQP^Dek}je7fD)8FLB=J1Qrj#*jori?X7S&i!li4KT=NZ@7RB{zV zlfXFG&{Q)FN~PhQV_T?bSRvEz^fPRf+53{R__R$NDwd@Xn@M7$j|0C?>ppe`vkL%& z{(W_o`bQogUzcYFfbj zH7`f<)73#4*dAUf#gm)BJ~VJgkVL3RliQp=mfRMkC82GQ%HOq!MNUv3Bf*cX{6 z63~$wB2Xcy6=yWZzv!&sUQ5YN9i>^?Z?H>c=WT_1ps|J=3+?-PU5wU9G2mg4@#NX` zy>%h(_PD)oP|{?f&bet_0{Y=gV?wU*d4N)yR^oZa#rgX8*0nKtQRhBsLaxS2wuGik ztilib$N@H_6V*H(RH?=?N8k}$8P$|*5w_qwl%nL!xzzt{dv)!#+cM|0EcKaj;SN-GFV6wb~ch}|Et~5f~4(X zlC~a`q>znBzkPjj!V}9{*?4}_XXC9cZr2j$^0p91?GG`A3Dc%BE;Q|YW*l@orDEGL zh5&K2q=eX|UTVcS-8I(nAV@XZ9~kNfB81s6x4RD8PY5raO^bwG>keq~qaELVFO4kz z9|9}l)=RC-2doG?=;yx)tlXJk_J6cdb(aAVL>JMG!z&@+v@o-H4GcDp@0YUtTt z@$4WRJM2$Wr()IH4!r_d%Bk>{L$9#hDv)ORP(eD%D!hpbiw_fzZ==r9hgs*X)H&ub z>j+)hVb&4GG?U9T7EKP?s|62(6d|ZSvK_SjXXO<8ZS14zUI&?9Bma|edraA zu?l~F=oK=n@G2@SLV%)&4ilTN^P0+cahNq<>opZEd6+eYK%kYWbC@-S$$Bx;Au0-G z_C_NadL!J}8$mks=9R@8K{E8_&v+B?d2q=(?BFg$>MdSXU>t5$Zcb6J7JqtBO*wzB zH+xkLTcUIf=*AA|`!L(ti14_0}6XE#ZdXn}TiX(F48!D3p;%Txw1j zJ1Fq;HrI#5kv-hHNLjYX0w8JM9J_JQpId(*Ysmil@1p4?{c%M?lZF|__5W-?FQ(zh z$YK46?dR!dUd#=nN^IkVu!e-Wp@z)o);N%!`SpRcXf}pAw@X~@=E~?PUutvTRZ_X+ruM(X?)vAQ0kEJFb$=ViLq2!VF zrrB$2btzfZP8GIAPm4U-cOEf197Ezu7rJZC`b}9Z(9~;8T9n8GO7N+%q;&6Io3-&^ zLtm>N&0>sxkkr8Xlz?VFXkmIEpZ(95)g-$3Wdlk*3=$Lg{z~BvzLDYCajYR2L^58|C)mmo&_K5i-1Qm zG$I<8usf(&Cr*7`XII=7!}99nxvzG%cl(=_bKmS3;CqB4M|~@d6`h88j&eT5d!5cY z2F0l(cwT+8_$CIZ1qj~#_3hu$q=RsW+>lZ$6>SX~x~~0PHN?v1kQ>T68W^M=g6M_q z-#*-i45HB10HQx^KL?`{%*ug7U_AUX>tQ?(MO-`^`LO#TkbmIQjvAw07NnG-D6@_h zd@oSw&RlelUxCyhKy5_zmR`&c^`(4#s(@$Z=Ug|W3<)o6;XSt6a&F@SRdQakVBtP| zDioW_;lXYBkz34fP|v2)_tfzV+dQvZj$1q`xSWkgGmf)f(RZuaBRpzBHqjzk)6D&$ zlxboFTtUk9=^kVDAlT#A)?0LDoWjlM$zHYFJGiuSjRXvFYksmu-VOHXZxCAYk+Q+s2zh&gd)>Uj$eV8ZXH11> zWGmzz#5IG{c03G84%-(BeD02zpy-r#X=hu$b=Ey0ki*fbiF&Pef~Ejk$CD-`-hnqO zwib1K-<-Q`QpK5@JD@P#WBmoyJFSyw+SEmYq&V|e)T|YA`G*Sbq?xJm$ zVP3ntcT$1RTIOHn`rIW)kZm#mkl~>>4k4f_s1O-#D?opC5#^U|%M|J7K5mr8g#D0f z%tVp!*V!$XA?N=%c3^d#+|~f8P1>BS#q5^8`2v)?BlS#DcrcrGoXYQa&BsFM+W(z#&z=E zMqWDYoNxUSGlb17^)jOZWD3`Ri+e8mAynCLV z;^)(Y1c8SWfi(e<&%0H!rSCi_BB+%dCUgYi1S)$2VGrN-{tY)nn{43bdFm4A?up@~ z5lkMdtD3L< z@G-W3O*09r&|KTsIKUQ<2jH1)T!^r8r=`aRuWgW2no(P5#et-KYogGgC^z1zjX;Qe zNnSTTg1uv|>e6Tjx#ap2HcZ#)OSclfV4PJe&EPH88)xm99hl4}ir5CSbNuH7ql2Fg za(d1@`?Z3&uSJc<0^7N(91d|cmsk!84qG>{Lg)(vhp-jQ;&raxQ)&11vt>oNL0WFY zca?_6Z5<1f*BpS!XU%CvRA#ROi((G$`fdC!I4>FNvabUFInQ}zjh?n>g!9!Li5zt7 zKuhdCw|#l3clD`|iXo;I(6e(og!pP*DvvLL?}z4Kx-vlP8@C2mA++tyuAR1SPCw>~ zV1E>Lc(v@YcnXGyij^TiRK7w-=urArjgdq#0F@dSwIy15c zlA#Eg5pSoKqC|}j3)2CTj1PsIDaD$wAUFivRM;Oo7-lNvz1cEmOlFpMw2Q%NNG!=5 zSBTBy2mI78!h{H1XQNJyLySi}^!LCq8)FP@)Ia8!p}#_ju+UgN!w=YqL;L`e8MT(0 zyexLsC}g|Qd=~4w5JCjBx2{q6irIt$-a>}#gsiKEg68c@#eO#F`j3Vuu18JTwC&3s zk0aAW`>poH{fTBPvjR~zSJQW)@!r@3aEXl*s9~-k)&8OZ4nA zJM7~U!398^zB`evL2VmW`zn_hE+C3N9;mi|mFAI$Bl(xKx<}9VTS?FEac*E)doXAX zwcE&dSlm*+`?E0;(qOZAu&M5eHqWPJKpX3KR&fq+oLdvdk|c`Ve3|Z^nBVX^)tu^{ z02M+N9=^jL#tLNVo+MsN@2K11YqU$gE8W6vmAl^;lkh8N&l-Z~ztH~Siu|?r#_2cW z?h52OdHv^1P1L2b{bOzAr%QkMZ9HT+mi={7`aqR0Cn4ug%udLV!R)M7N$!s40SJq* zDO@p_v(kHxCN)PMEdCaVT#)Y|`?cW(VvdTmzs`q;0{n*f!1l5G$ijwG)h=&@Q%mh< zyT~ZeegMpg7Rod%n~T$1(}5L=!&?E3C*?PPRLiL#&oA#>j7-%^D+OT}128!mgN|`x zv666vWtU=;`d7*SOSAC)>768hIvQoK?OvkZAQl7HE}U#c#N4v*Rl-Pn1m zi;@-DxXtN}oeSYf1E;^58yY-~PvvLR!R}pw88?MBvX^I>Ik)@@h&F{z@0SKx%;Rw=z zxpoJ-T-N!uHY_gQ*36ZKW|DE(aP^}^K#Wvb*ZB>aZ=^rcDo6?Cs9rEkh@?CK1=IwD zxpe>aLPXQM7Bo-y;bYWVz~kBSLH@5W6th;PLlmYfAtN)@vBF$FplMa}s7V1S6bj?2 zXGj+UB|L@gaFC%GIG-LEBrB|R=2KGP%JzBGL8sYOXn3`Pu5?p6@T6l_7!&8oJ%i%| zM-FpXwtpdX4uZ*H4`bl(;mxIRngZ#m*5NETgQ-mq@)F5oj?jFCP@ zEbQr5DCVN>O7TI6f-b^?FAE?SBw>;JbRNm}fq4V2_zdfbV7po;EfcbRS_|rpUpFh}D`I+dFJ8x$y4GE(Gb20eu29ZVDrdBcGV-n;E_PhJ<8XKu>X+Sx<}z z>1u$wZODTaXKUU0?49ef?ZZDUU&W;D-Ui{ zxN57G28b3Q-j>g7&0nx3JQ&Gq+e5f7CBXAL>gzgBYyZkz4=z5~Uf>_I@mI(z+iQDr z>IbqF4_p@*vq&GN^Vvvcn=^KnUQlui;%xrAn*hT;t@eoV6uHHmB|NX#b@v7NRs6j5 z!=ZhDaD8Z5e*C!?B1?|Z*AR!1M|)TxDzP?xglXj1An3_d6Yv#CDkhL4saZyn^8iSaHIWh++WsY>_5UNZJgrbm!O{Q=owJ1k zLOx$V&!qh&-f77JhTdN9Pf=P4Jm4l#kjQgangw2Ms3p_J8l}bKwH#wEl~_b8ltRG= ze6qhMp(Qni{uPGD4WBC>$l?dCA26Na^XWKjHAHcRGaW6C2kZvs+lrsnjr7Okxi=ji z&t1ZtNvaRs z_>y%n@6;YE)!co_)=qL>T(JQ^=S=-9=nXO>G zxB9h3>HN1q;_7#R0W>c;09w7~-5eZ5?arHyh-I8>E^Ur2Emg{;yoS?gjt4gkZZ{9C;1bvGHYtl|W)VK^z_!#7Uk5c;zGCeTK3K6JI>#-j&D0R@Qk0=Z`!J@d-OEMCAw)! zDn>Ft>9t*n%KpZj=dWQvhknp8mYa=~a8f?I<`ENPR);rpHC$h0kZn=Wn$8#+KBKZZ zT^g|s7aO1r`h6h@LhT>m{slRB>YUvfsa2|23K9Z4d`T_0iW#B3BQ=&IeHQ7fYl1n` zh$~Lcm2JP`T%28FqV85{aC~q!o%a3WQDr^Qm2xs}ijH!czho#4DK^}s{w!*>4s4dCJVp7ff+5+HD=FDw2r znOGKeQeElQ&VOG8e}DdhpH#thosO>bYvAQ zC)5ynHXxh(Z(iG*E;B?F{T68*v*~R0tyDk*s9=|MJ)QJU`LGF7slH*02=yF9<0Cr} z>(hmx{Qf!5RQk~A?3DE571~2%^gDi2cXf%q4^siaYy%oHC2x1Sj6y->zVP|ABWSn6 zo?Cq|@UNI`!Rj!CreouOR2w2dSk9P=_j>US7!=X3LQ=^(W;Oa6 zq_w^G!oZ+tF_;x3#&vaF49E)|NRIM&*lxBwMLKa4Jh;f-0`qoi_X*a6zT%EUa4WrX z=MvLmxCd~}NS{e{c<(7!p-ZB=hS}O#mldwsm&NJJVBk%7abei9of3vaI85M^XqPnK zC?3gWeWi-sYuc1U$IG(Dx#&i}InB+i4dATk_IEd-!~-snqSxOiW1>+Y>M(g}9RuvT zH~FPLfD76e4Jq+pLeQgd-MBPp%lOWyrUHC0}aJ^(hvPAZwcF7oVf>26K}RlnX`KDOhtCAtdBUq0R*!3E>9li!$x2QQUWMI0b12En`$EiQ_ZW|a>7BdP#ENunMC=Y$LXuM z16}4HCm1E~eZ_4{9W(>!O@_x(GH zEshp_B5XXq!5c4(mGS;q^2( zT(J;!7iL&Q^^I=$&pa)K?Y#~hj&S9oolXar$6O(ic$3d7@*E==5s7=Vk!@xNGo{3v zZ;I3ZK(0KcjSMJ}h3~;<+bhg`(P)J2aGHqsZnp!5Ji#g-h|%Uf2Z~WK68}B&XoTn# zWuFoZaH#4%%AGHTC=}Zq3ZAQ>c7-x9ESq8vG2xm5CtwAHN+igpQxf@_<%Gr3A|YXH?`Kf(0Lds1>DetG7=-}aS?aHQ}88hP)p^=GhK_aHK3L-cNhE`VG*Wj;xkK zYg$YxMhW30bCQ5GajNUKO8o0h)zu!l4*pY;_{sGh4m1wJ7K%G59afv25)lPUtw`S* zz*r+R6yj4$!a2izqSK(L7^nAFZHHTRWH63eQq%THC9K%qSh+95H`gc$-?mNj!#Oy& zcYPoZ#QC%=p%6Z0+f=sw4R8H0BrkXp7$XjIzSIS*um-RMdR@_B)yuHwxryS5ya*dd zZaucAh8vL8-_$M2&8HG%#)!7%yOS-G9ouD2_sx@9>68PSWX&TUViK7moEz_px+c$w zU1QNc<p~0fgn!O9SWI#4BZgrMw?-{*H(H6qN+D`R%7X; zwlFsi6zSu9f3a~@X!b&{cTNcg*tO31@Htb7sJwJ(`lN2d8DA%tX!#UNGkL%&|3}g6 zSk3aXMkO_mz9>)gHWz)hIz$(ON>ianR5tl-ZHFy`?9$G-+$9pY;Wbk||2S8N1ygzG z`Q!$fW@dBA)zyDzO%8(g%|{_=ssi>dm1%i&$XZYQupezA9X{J*9Ba^lo_hX1GRAX6 zfobALun>3W5~#z2a}z$E5Ug^(9^X2*!pCu8mMHL*h+uxQJAIRje<(SKLAT9Jg7)#0 z{^zUwn$Mqce(T}2X%u-I9%3pexvt9f0$OZC*M>5Xlm`l_B?B*ojkNGk9Gc68djRIF z)rL2EEawbcvRct*z;!%ZWwvZ0G+OsYAKzXC$D$dQ2ASeTdsfvs zh^JCPc$_PC!xQjLRg=RWCvt*)KdCR7LqU*JGOpXWSO+4;n^FmjStpl=?D9be#>EWH zqfeNlnh@X?Qlq_eHUJl@<x)zA8&ZMUIhVPtHE4}i(!h^49Gx)jA-n$!Y2ytd&CrE;b; zw+*dHrqr9=%y-yni6PqOTpu8^J*O@bbJsLMWy^*I2s+wmoprkM9)Udw&z`eEEkT+c zp^QbvdMkveHgpJu>%8!-%F?j2aKZ+^iZpAt?eH{fqiO{7sdaG6B*f0(-tJi`3rAkQ zMrnJfTcFR=6y+f>zhPQM`@fWy~^5Po~u%x0p!E`9!eY{Xn&@3q|6{Vx>G+teB8U?l8M& z)`6Fd*11i)%0eSOg2=Gj>a7ZArm`hZm0v;?xAS5m+*j_w^$q6?OF+w zhG}|RT+9FB$C0Jmj`E-05N8Rg)3Sts5n5<1i@dZRf2P*6b39SXxwx47xY*G^b&Gi1 zUc-e?5j>NC%V<^f+&oz?tmK7}s_pb+^;TLbTCcttLbJDh{WpxgbT_EQ2CZzIH9UN?bY-_-ZcJlsnKj`NY}Ti5*ODo zEM2Ad3SqqU_Bf(POogVwR(NE0zPT%iA00oRzWHp-qF+#bQMo|=^Ch$%^KtQH{)=%H z0lYZB;RP3H;GyVM6>saFYd2Y2pW@)G6&xy%fB(7G*7u+L)XDr$$0?$Ls^`sjoO|j` z_r1CGhB&Ul3gClw@*gDK#3n1)mN$(L@Ub0ykvH+qcO*K%&ozMK+qnWv6*6uDob}5E zYk6}!t#AMWBnh{?+T2yjJI5_9{PgBV7q;Z;IQS3b=h;@_FTX#U&6k}&$zvYP+M{py zqt*#PYf~*)77y)E*ipO}Pn#8g`yP0R3)-UA7%f@Jhjyf2t+wtONoqUe9qvo4;!B)4 z*gp|4?IrnVqRnHKYK(IZw*M~2HFe3-N%CLVEvQM}-O%B> z@}0WRkUJ_z89+0=A?b{kI}0r&HE-elJ9UbXs>&~^mb85o$&0zLJth?3G+(Hlvna>^ zzfcxYl)qZvgh{`BHs`KS?&w1;pc+sxp<}=qiY^l|^EAjPf?g>$5p` z8*%F@MdhdB4|m2wS^a_1wDfJ=pwu5$lh$omk}csj$eA9q`85f6!|H}egl#dJ&AoV4 z6zOVFJE#c7Jg#AwHbOIaRuZ`te zn{#s2NdB=}xcR-^uG1^;K`j^HYWmctB2JtlWfkd6Hxe&OI=M1BwioQU!wrG7hEfX)SwmY zC}W)gL)2B#)tr37GeF6gSjx<0vR**_v;5(AA67$p*ry?~z-h=A8qq1f*FfF;7E!$@ z$9~z5bze3mrX|OG(rKQ>oAmoJ*p^DLEx{0v#kLh=TbqV-X}pxTQN||K(|pI4{I;FU zv;^s4C+7`>nN`s>N>67$xLx@@!r`B2jnW^S=4Mq>OJ8o)h~(>sjbQ!edf@sGZZsCR zt0@J}Q|yLE97kH!n9?10D68ZXbQLvL)r5n_fQ{_asp;tW*b``k}Zo!$^UGO;UP_GzUZy*s`+lnYjm7Kana;j zNcqD24B1;^Hg4ks2V?r4rAJ}97c=2bVgnObdcvMx0xF%(6^Q{ zqC)uiFN7?@C4E(;a~vyZA;okub<@ ztc{fLtlYpCV(Ec%GvdadOWo=#ts^}!yVAdkJICcQ7xOYP(yzvyW36)Zyrq{2-`!+J zkJJ3!JH=qJb5~zxYcd!l7(MjLoS}}o!`kf0W8thK=7`dnE|*987f5Yi55hHW37wu? zMKOe|xCYkhbB*y#SA1sdLQ`v!=Ncqg7@UKnA@YPF0$8SjKjaU%NSmYyGHPM$d3mWD zKxaM+aI@+4rK%aOFLoCuUu7OR-^XRXFOLAwH3ER_kAO;uI@JgxV3awo@gcIDX*>oEG675od(FoM`VIGjFjCRMG*L+^pd!_UL9jHLvE~r< zPlwF8Kuhwe4H7VvSc++teuUF$2o{<`nGAI2tIssn3ym67K{3MTDxXgQ^wBg4y;em_ zb+AG_3t%kcj6HOnvK;bYWIStv+lGm2zHntS@AxuNe8FBZ9)=-Q3(4ciha4rL<4859 z)V0n<2p!RYOCtL;sAS`Y^uqpVTa#0mOCo-@Kp2!fP4cI8Yh}3t)YbHn%2>j6d$OT7 zt;Z`&DK6PY_$B#!cdp;MPR}=J%Qfj@R@lTZP)x=i-hNH$v;yK2Ng7AVl&z_w{1LPE zO`3os7v$I+>EeJnTq{SIzmC;(E&aTSa$(e-A1f2l4jx4LO>ug;{Lj2}HSuevJM#O? z09e*mSxRf1EK*FyQ5am#%o@oNPQSJRxpePN#=;u}a+Jd~Fag#RO7A-u61r8&gxkYO z=UA)F&7-vOfc<^Y{+=c4Jjy@3Q|7r9no2gRo%8hPLj5@_uhQqY;Tce7td`#w>wh0a zY)odINi#R=1KUnF3x6n1CuLhCcst>-gzhn0i5x||2H+;!$A}Hh95f~qCQS}9Y7UYh zeUF61vY7gWT}qW$gyiqjpc6-yK*gr@oh8CS`sSLZkIbC*QYY?Fsy(py%1RovS^g3V zN@XOu6ft~Zu+%{AM|Q5)MadPYCZ4t>qwEe`OzG!L@+=htW_3**p0;TN-9)MxS$#Yp zDvzluQ22oZLT^!%%9`YFf!p3Kmp3GTkqrC_Xliv6I<+3si`?pENH8P|+5`$%okiYP zq@@^@zZa>^MJ8no0V<}vOFj^SR9VE4*IR~!;r;J_;Xh0nAb2H-<#yGSSkB)<7wNlE zMaD%?6EZIJRi>QJbJ+;NxWL?#_$nC~#~f&2IF|dCh3OFlEu4;2T22!+p&j#4sL)(+ zI;OpPe$Hmia7S5s*(Mx4|m;qN_Jk z(ELC)Nred@H><2z8G8L#oHEcmW>y-t7qjhZl0T4{NdS=%^CkPB&jC^XZ$YaCUcim* zyigzTLgp5xGeDtxFK788rJ`~{&DJIHjR~FwvN7c*oxc#=B~US5UR#l<9XKKQ4(GcS z5uU=!4S3lkD9AHHpDCVMAj&|=qxfqa?FwBo7SUg{s~rGWj+B!ml8FfkT`|P8XeOwN zb6PMchM(?+3z%6m=lS|zwP#fqqHS|C zed8!=o{jP-e_D{Eg^=&GCv9BoI+K{%6fi26R)Zh>hR<}pWcWw&7ehrKjs+t*ED>@1 zoo@DNWrpjZ!kPAeD3N z7ozl;*c7mJhd#d|ey*uY*2kJ@q94zVs(K24mH1o)MJBZ!TA@W%`#pGbdR(gJZCTkq zhZsh?(p-YDk8&}|zuQEUur_}y^Gqy*b53d{$T#>{Gs$>sM9wp8cl}<>=`L6d855;9 zS38<11}OlE2QWTAN1suCCj7(~Z6dzdf$MJ#tAX7znFKG9*YH1BuFzX2ru{biHi1Udim~=R6K}qebCj10gecq+{ z3E~)QWC~&f^kB6cCW^~ETO-gIVzdWdLd!Cp7?w=0J~GvXrdvRVVvYI>3|ld4MaoNy zLh2(Cc+?P>sIrm(re+UK7Qt7$@I12_tTuY1ths8SSi3m3*IB6RL_1yKM}8MArKj2j zuHe|K5&+!3LoI`~2vF47N)}kWj|Z!`vZSqz4{EM?#*@X4#@& zLCwK{UqjGb5nVRZYRVE(GGg2D}L;3fG3UsjzOs|KyHnywhN4&3>BTNL-f z1vj>_m*4bpL_f1mLM*@2bm1~{Of$nOz$T!g^mk;T+0qgI()=?FncK}6Wn60m?Puk? z*q3An4R&<*rOfnTobXNT7hH5n;2)@N{DaeAwpTCsho_i(EfTN6KgAF6PhI?DK0cer zn3sWn8hQ%?387gS<;U4yV>)<6B3C|oKKAgz0?6Ie zHx@<_O;hYzy)di#29+8!Ltg@8f%B&|olOWX=9F5SkE@{+N=??h*%N~O^~ce=dru%S zU77K~oZ~Tqlp-c;%~!5R;`y8LXX+HVcwm*VJkiqVH{)6HiQyFtdvPoTNIi=;89I6Z)xH@NeoI0 zOGkB4vxt*^84O}J@wLMd<=+VYmr7yW6S9%@n(JsQ-lQV@#wn|LPGC&>g`_to@k6c# zA}TdI-OKWq|0%W-;Xx37e^qBj@Y}Il0P4-C<~~e^^yipT+Ots8Z(z>y-yhn&K)X!2 zwDZr}DuUu{UCZl{s=cNlaJaP3WMH5x`22nuPz&x+#6FW#SjqqOQx0T7MRkiO1~oV- z6Mam!3@B!ikLuU>g+ENX^sQB;tkRn{A{a#1nTv#wAmqR?bHh_)`y z$+a*zT8vdHi=LYAp|kJ)#kbqOJ5f0lBdmnOgA^KB-^13r%Dz`NkZP5S2RHOOTY95w z@EZ|YvnJWd@a-N#i_59XdvJ+%A{sJ;F4sPTeY;Z5Kl}C!yn&kO?1idaM>>|_$w$~Q zlOsJnxx8P1hXTjy(wLxQc@l2{lIFIpXU10#c-m;p7F^TVKR*d6K_QD>xr)tG^^J4q7`^Ji4#z6KrLT&o@XOV9u(A8 z=F6zjTMger8FUXH42B>&i37;Qh^BmXnNf9>aEMH~I%f-+QjVOAZqxs)Xdxy3pr3t) zA6zP;PZKbE#LR9~ummU|*_ll@jYyM2`Ipfw26%526;-tAz9jsfDo8U&`w)rwGG8Z^ zzb+fzs;i!(*q|(Bs3D+FPUY+dk~!u;!>6L*6uMLF5|M9*>1I>mSnpV zzz#v7_f)bC*~&RMyGNBvx0uX@+;7+=T)mEDx1HS;J9N@#swz{Js@Cua0)fdg-qWpJ z5L%#QfzXUA*s`UUFh6LawQF!*%Y+z+`bd4xgW|AtLr#g;ypifXZS8Lc z&WG6xU$rT?hLCepl;4e@#I=*&jWYyF%7&x%wOx&t${3BNTe9@0HfU+U>Beswkf1?o)f=av(R`7DY+<;BIaM!dFhu`OJD!UrC$4Axu5qc$c?2X|tb znGD}!=2eNyurAqcllHW*NZUuieCyBmQgb~JA3T(GpVEO`HY(9N(y)+J`(k&zut=e0 zGqJ7XE(OepvP8!aViy1yAdv#d7&5Q`h{vu7%0kBo==oedt5ylzXWys0oYo5J-~QKax?0ypxexNe7b zyaxXe0N>;ANGl#08A(PewdzRCV$B-)H+80@$>V6GmA47zX|(cDJ{W0-4}y?J_#lj~ z#fL0r-+WByP|6+Fsk5qv9)Q5k9$3;GPH>{`#0ILRzhHhzHbOV(Slza@S3xU&G}^=y zsppXB&uWUrxkR&Sji5ZSmeOq8g$`T%jl`{cUCrVwm7S4EMKR8`x@sz@~?t~Y19RL>k)7yykg=5 zOPwOU`aKb*xNWO>l~6q1#XUrqi#Nzws_~C*BgQu0bElMXtYU zs|`Q1n0#L~KW2ODO4gv6%Q8QrpX_z#F8i(+Q_zUA`B@?-`8?;I&@ewssboTaPL{%y zY`rx};vI2VqY}TJfXl(z#AuN8THC|C)Y7@4Lpe3~6DnrEwzpST%>F6Hcr4pYrh|jC z`M=TyhO)b@icZDHfD5OkzoE}`fy$Q}wXCXY6$~)3e1yUhl9@{H#CztQ7Y!=!w%)OX zvMWLD?Q||tdMrLgUU~SteQ6SaITs)oX`BI3Iq`5eO22!z`3Gzb2AKvyglJrMa7Up~*VtlK9EJ(n( z;(;ShN~tyG@$Q$Z_d&i}`Sgl`;M~HR_>L&y{ORknn!hw?~vOyshT;#vEy;_9mHs%*f zq^>N9WD&L)bH-p;G3~;8W`AWOj`HZj$q)?A4d=o>@`S}}czFRWa4`r#G$$IoW79N} z44_+q)YFbTGtN%1sd+-aLs5em8|y%rVqj_n3%EhaSX#`vx+;}grFW{!4(ff z$EHqwI3O^#hZUT)2ss;Lx0!Gv#qCgA1gUZEPU3HY1RQtf_Tsey@AYc#Yxy`4nQfX! zxMgD?E7!g%WP*ISq+#r)RuiI33z-;q)5?sL3*~FNPe&EK!`_61eUwcw@nlnYb9}Uv zuQF9XsZDQ)AYi#ciWXv8C_q*V7s3^4fn^n*XxkN&qE`7If`IeO zvBYboNS|{J6PIyU2I3ZeQ2;(VNx4aous8@ZEb<8WDmr?kQ(2aqMD7J1?IMJCSYTe- zsTcjyvNEpK@)k!FD&`rK@n3mhV5?+F{!+r>t5Fiipq2_ZUD8RAdDZKEx5o7Pw)~CB z?CsY{d4U=0ugH{iCC8Ae9*?@)MK8G)tE5PBu!;kS9#EjPCc_!4LY@yc$XxCh$=Ku; zVS#`Iv4O@=%$=cA$pgxrg2^oprRKrl&3=F5b+o*|S59gc6L}$*2O}s0cHMn8qYETd z(3mU;Ux(qD_$diY4IBL3S@Tx$UVxGlScg7Bo#QkO=dc1)NdJOuE3M>hhWswF!<5>k zwX2d;b|&E@N(GjhfmMQX)PZJ>oF&rC(};cEzzpJ?INu+ouOk#7=-uY9KDA8NOa|%9 zmt!;9j)-swSLJ-9=Nzce&E!R`>d<+-8CHqo$Q8C)xl55;wk|j2s_|4i&LaDxZVX(Z zvtE4;pE3roVic~!-Sxd#2Dn^AR}?iW_iNun=M;xS)t)9en<*q|S=rOQ_SRXB0YM}Q=TR1MB(%9nqRH%n2cAFQjx zYEeI8gjw8&?V0E@j3Tp`vCES%6ttx*Ty%dmeTdC4%=0%U`Dtb%@HW2=7yKKaEVM|df zjeL3oFDtTB6o-KZlpT-6w_jQ<*)Q8yDiERJE~f)NmYN2&!K3)C-zNQnyrO->6lRT% zwW5LamUh&{B0LK*gNW0+Q zh=U=$UVO^Rh%+q4DOzU97V$X9MAx!eKD?rKo!Y46BtMxK){(4(az~KKTL6ur`Ove_ zD!L8&fviZ(0G13yO9R3ii-Yy?MBkF~G<= zt^@wCDOnc>P=SMQ3<=R{y}-R%t>eOycfS~XWf=ORve_6({!cbA%ozbIk`Q$&Ow{;$ zQqeTd0_-cClAxO}mD&7Oj$qz#Gm}1jx&;mxwbQFKgo^abiN45@faqt2o4c3Ac|^djn?`_QZb6W1)=aE3)PA5T!`xY#o+K<#XK4>Ehl7WY^6Dbl zrFx$AOlQ%IT_ekr`Op5Ug7zyEl_7zz`y5*YY3(Dh=T+>fyz+$nJKv6!N?{cv1mUqD z2X?kUFm$kUd_(P2lPpobcD;mt-1=Ia#OPZpR8^Qpl4eIQHR`or5F45#-X^HgPO`b~lhj*lR%qmaQpGzm@v9P6Q z@*+KW(H=VU-=zP`D!+X2QtohgM=cp~VSujsDKrHqvig7NeLL9$?fuw7q=QDwcsBv1+GZBsg1gfc=@86OW9b?f4c*4{2b zOX3SHh_z~(h%OOgI23r`y&Y3I*V%)6^Emw81DqL-r0FKisI0fu1;*_uNT$csH$j_)Zc_! z8`;11ihjGWUfa}XwJ(Q{B%eIMh$2SV=DcYZr7ul1JRcn4mIn@wYHYSdu|Qy`=IvnV zF8H3H`-qt@IQ+a{^At&-I3hrURbpLfb@AsuP|<1vMH!$m=@L;tAnIK*yF@e#eLzDx z#ne)8p6I1c95M)e+ajl4=3kHDl}DpgCs*)KvDqOBfCrrGXlR@~elt)x7+z){4I5s( z>~hexg380dYPY^xkH_R$`97=522TVJM^|Dk@FomPJ2O!o0NdR*-qKO#EICOG<02N8 zn(ZX0KwiWD4D#|UtNk{a8J?#Vsu+#6)dl!6lyg4In%DG3ukN>z{;&=QQcFQ=V_VXFzbjw~U9_#;&cljQ<0{ET|Y^-()iVXR+d(KGGxUtJDsjbFiYl z&jQqC06LnriT5I{iP1qQ;m%?1t>Vz$&fn{@Y1`Et8r^^!Yt$S(m8|tta}|wh1~P=% zZabMN5{uQc33bwz?-e_rZ{f~v&D>F(01L4#fVD0Sgzgu?u}WYc>?Ys^`L+DV@ztC2 z>Ha<9MR9rk2gUPgZbnj_ETImbpxNGdKDu!dAArmgn;`~)1C;(go%;yj9%(<2BgcmK z&Bg6os6V}xWYk~glnzauKPj7pIlmoQXU&b6Pu=#CnTfr+Tz3_ka4)1ViLz`LZM}Rj9)O>Q$QIH^UZO0XD#4*BSg8@- zrhD*4w)R%zQHdgyrZSKsi=>5uDa5pf5gk^SF~7i2XcYV7QF=@sX?=|#scL7O+UXRB zQEjopGv>HDIwm*C<>E%IQ4k@vE&phQZ#A!zJrz*`n*uoVu8AMKhu9C2LUEc*JNY}A z4;s@pmR>fC!fgwgkX|9I1%+Zzxmt)9}FTSDdgR>j;6?F%%I z-~7)abgks}u2hKfmH8Y11dh~6>qw}{_C73d1%qO!(ekUx7|}ae>~<_IiYq(DjG+v^ z?5C;LRx@+bq5?7QbW#pMBp218CR}`uT)GSgO6kWKEVw4K2w8L8yJB}QvgXh5n?FmU zrhGW%7UV+S(Jm&o&h7(o(2ZM200dwAjq1jrz<;G}N4B4cNm{<~c}t8)Y(yl`K!DjD z73En8A(_f2&~J!S}a$vV|?L*Y1 zzu{zcd_O{k$Wma(xw2SPM6bm6`uK`io@wo$An3vSky~XMBXg_qqOnEzmFi{ClW^$yB|ek+_%&Zyixv9 z>LKNIfqKksn>aGT zkLm|}F?A0Z0F@K_s_tXo|KzX!1u)W;t9S~gQ}+*So*_jpKcU>z{SfD9O6FRAGcc)p zg5RjI{0``5^a$HwS{Sx<$u0;bYO!U(^omNhk8~k++5ouUC8c2}5<1e(PHqw61o~iB z*)k<&VxU&b-jj;XqGK5f?%*iWz~Yw0O(Jm_cF5>TsJ3YanLsliHGgMfxt{=@T^58> z=W}@$HX%JH`;XZ4NzF4P>O$tFBK60T6BDKB2Ah!EgtY{7%?A@%!U>v?4#dcs8o4ED zra;br^aX@xL0Y6@&oCF&e3!yHc?8IeLPUIjhs4&nq?$lfO7m&OU; z?P{H9VJE(@jUPL9+jUL}!?8~V!qS6B8W^_E3MS+uHJMX10` zEub!+tkHM6N)=23X-l@HiBj&u>!rN2U^KKQ=?jd+2!&3~E=0pYX@+x%l>oASHCYSb zB!zyk0o26A5+*9QfCp}OjRrW4X!exUfY)9Of>Dyz!xs#QZBSJo>|8|Ia*;)13UOVz zmDOaj(E>rvo!~1b531Kl^XnALQ7*R>OT%N{N%P&Z2ZRsCCR$dq0zgXPWyumth$7-O zy(nV1Fv&pOf$sDMWw9#S3*sz&~=%XN-*G1?lHX~V*j3-(HjW`{mOV)_6pe_TDy`s6H^6>55 z89?U34!Pn`pR;2;G2rLIBhQS4bSauhk01($2`PPzbZ2hwG52zsr}`VGptAhADl9@Z z>vWpE&{u?LQY(oHlbHr~9$!*a?4M~X%p@CRT0uInq4RSrzaCQ*Qhv==w(Koh#)is2 zQIQNilUV($l}aTsvp@G_JIH0957+bZIp87DI@De~py+%zyKTW;3QP9o?Ew~>*6UQ2 zU6#c0ns&n>OhMgeV2Nk|0UgJ(dlwGqq*76x|835V#JVmEzhx)t40zChh=;1mAH}{- z5tQz$=}-;1;k}!nQ0#%fl;H!mV|6b&MV)N7QxS*v5Ll+!bfcZdN|>ISlGiSBAHOZ4 z2hT8$uAb-nd4+fz+>E+}rkP4H+~(b}u^Yywmt$l7kOoT)r*;dShC!S0um&ByT0J~| zHcYc}ShNpc>0!|zU(Do%d?DKue3^3oh{DrcGR7oP1dSARF&EJx2NEmT@Y=X3_H?^P z58E+o*>9^!ZEY%tloyA+ymMeo&VotBIL!ChX%MGoH9bH@Hf;U&0JQe`5}cecKS49G zU&5@)_q)CG5%vVw50*%=4UM^1Z(A?>;$=mKgns4H6=vBnV3p`BN$MxU)DDu&!Z&Sb zEXe8_%2)EwR5%nKMOAd(qvP76X0H|_g=w3vV`d!mTj`=*?%QZ}==}M+z2S-wCMjt8 zopFQ;MWo^od4K8s-W(ITzg`@(fGI0u0EqQzjae_ib^d8v(z#+!&}B*1Oah_;VxTj1 z%ik46Q*vVyT?IJ(sH;|WucOwqRVxac)f!0i!gj47A@MdH|IF8&?ihB|dG0D*)3RK5 zeM_O7565T}%g3A50T}|Z*6~o+ta(MxCf|#7_O;02aDipzi%}n}Sw1x<{17s(zI!&V zpa$!K1^^pF{yZA`c)YZgPg_$LGluJ9>GrfnJ`>-FD5~`ip|~IJcukh^j-f9gEF7{f zpuR;C<>c10wWX+^-5Fa5RRTn?E%PR)ODG!b!u_j#6Et8uMR1o)p&T7h+zrH!%mG9-%pcP1(H;XXA4U zP2wr@wurLasAL)#0otX&;(axbh`}P6y*7zkxfWRsiwFXcsxvHs2a<|64a*Ez#IHkM zUvTzV{uXmoTc0K;w?uDqADE1ZE!i}@=%UpOvpmh18>vWROhdL-X87JJoyPBSx$s78 zt&;fOfge8o?a0w*XjV?(`~$=eP*1=i(J1w&AU^?7oi|GdJIIqgJbwad*snQ>6HDXP zmt!PYLgGm93rgrRcDmq{Yy`egxy8===i7LVr>YoCxtWNU%{}YUs zrH@kBz_1dtXeqod^_JW&?_$!#X$qYp1I>^wSva|7BN||abg-ADEH07&!aNKM9jBJI zeG=U?9p{J5jA#(!Fzz}7hnKE}C6wc)_Y&TlQ35P8VHpZPIs^kiKmO>`*iOaq2Rn-6 z$`*m)TeG)5Zt4!vul^U}l!?HV6V(-W$%9(vkMLEp4i~ivOi~M0<$sQwHNXrI>A9jj zOh;uVD6E@kF5yVZRH!>|FiSgr%PUL?LDMQRpZ5sWHAg3vQoi$z{JpZbSQVP9<|=5t z`(AY6n&;J*u3abdoUqIA30ZSE@#TXRri}$Zco{Pp@_$7NxSqY8?%7ZgRw{p!w92R} z=0;02J6drgNfK*0+bBD3DVJ%U4D=-wWCSb`v*KBRp@!KT5$(qo%|ZkeUQI|2q9g#S zEeRSz!<=Kjv$EWfK)^JBIxH4|vB)z7h+Hu)T51r7`R{zTKF1Z~eWO z6jQNci~OnvCsAF90Xp%i_kY)yqNBKCR9}?8TDjm(IAw$aGN0_`RoiJ+}CV?lnr;NJwm@oBs zNZ}jp9s{Ef`)OKxVKYD|Y1RRCjzOn>IxBO5Zsg0z=V}Rg*BV9 ze&{(c)kQ?XXU~I#bq9iEN<1~r9ua}Zj2W<3^2MI|(fs z5%^1-wQ&4^5!+%QT1l)qc+SMFC)ZWoBAJ|JVWSEkrXFYK$H>2gAwt&%aek^O+Q<^b zn4On8hI=NP$?zWq@#>A<>&8v3kROa+R3wea@RXdSreXi0{O~FpG|pma#akzV()@Mc zzI#PcA$ziL8D|f1{O@YXiOG=ttrjphqYrCc@vAWA!N>1;*9CqNe!9rK7qR~Z^9V8h zBa!`kbh9Mokw*@F{IA0YTr~7*8Ihv!Y}?vt9#-9L_kZuN{p)i# zbNRN@{<`~A{IbPd{yv}0zYV%;$c!FcJk_j(>n;;#rZ+Ux4dKqbAzDtSH(WanXRCUC zryE7GVT0)_@RSYH{O3j^_9G3>F+8P_Ne${(sB2prWt*pL2t5S%Y&L{-ba1MCCEB9l z^tdUasZbFh+aQ-&?GekX?ogBD+O4TyAgz1{!l0gHnv#=UO9#rD1W0+k7$$?)))M7| z0c&M)DTA|FiIKIc3!`L+8Pcq$;So!$!##?w73>S+4K1b2IQVR~uh#Iy zRnKYCz%kU49zQ`U!l(*(s#WY-=qrC7F8!^}sCy~=%oL@xhEPuDO9(dDR>>d!Pir&ex zW5H4~WCreLf=ym>4dNI3_96y@A4my$iY3BZ-N7*36QaRhkuLSTp0zqVR0xOf=syD* z>wR1m7Lo~*dE4c|=s|qY| zh&SO^Hl4=x;IC&AsWk~$#5wb^yjdr7LU`k5!L{VAvm0H>5Z&c|F9-5rM;o$uDHAYI z_e_yC>B}!Q-o7o*J`)gOK6d8w*F^Of66L8Q+?OPjn4oknQ3=u|u$A)f-1ZA0;R;az zzD9ib`LR~LbS1zdD})UQn8O3c?kP}1GAS@5HBuA^{-2fuVEpYZ^pdzhMoD>^G*bG~ zLWF&id_no4T5IT6p-RD7Uf>*~rSAL@Scl(fV=tp+fe%@5xGmXZdy+AJfFL$w8##fn zHQT%LGu4?6Ci6;&+}n`lw|H8Ig#nJ~8&~Zx`|WgCDsx3gInjf;%z}gYG%{hfSM%2a zeanq8&)6@VL-`28sr{(D$Y}st_I4q_uC9c_HGo-Xi*AO?U`Kq`X7A-X7 zP#~+U?ENnqO1t|jw zn}ZLNV#^&4is>JB*IX5A>K_)7B$}JOGjEcM#e2zmWaCV2FV~E>AXMI}%zR7qqSYb+ zH_3b&wH-L9k(zmdX9n|oDid6fyvNwRioj6wmr+XcXg2EREFah8WJV;p#pt@PJrC-8 z23FkiOM;mmV|j;J$(bJc%jr*+Po+yh zl81X(iZqJMn3uGRjms?v6nTn!E858p^V6dH~StlI*`?t4*Uf z#OhM6psR@p-sUuNONzv5y=3%cYuHsu%BEeeYLPErBrzUfge;d~yGu z+V}Ok@mWj#jkzOnOBB;ZN^r4Fr2&_L<`@2W1*^)J)TE*$m{VEID;miaROQ60ostA7 zWX#nv<(64+PIj~%nlYGgf@cbW@?Wt842sqS zI-?|eSj3zPExdl5&|>tb@m1uUyYySUTi57@HOJkga55&=T^2_H8yk#Zd%>5bABua( z|3%%kq;D4Y32%m4+z+nwYW*dDBq7YS%k5oFNGmwT%*mWi5)H<~#Gqmi%7_Z27GmN$+PJfkMSs`%WoUW``Ag5%seFEsIXUDRJ7+m7G z1e;Yj$ybI|xkBDJo?j6MWBMYTao})JMt$s5J`g|3kKXZi%S#uUJ-Ka+w>(=g9FCAL zQo2nPHtW329W0w@7DAm^3jEkW>ShoG7HgAo?xgu?L^onysuaDZc@t*-QbE&Y4m6qc z{a?`&lG-srId7@-2M35wA!P%GY@2KhZ>Pt&Rl@Ib%#Ysj-IL9Xt4d1`b=ggu7sOZN zmA-f~&TkaYwR;kId@E1$3j2pUUlC;ZEH@Q6#q-}-HFBcDP4N9dAW)Y0Ev4{ETj92R zVX3fC?(&uDo*8ESy4jaqUXR(%;SnUACXo@6)lk^mYn9e$z43?+ta~6nR*66K45nZz zk|i-v`XIQO@s;tcKuG%u`v*m^^Xg*c4dlFxAY9pf##_7 z^p`Qvnlasr%*JUfjR_1f|8xo#Z1rsiJC&+>P)*QC7++y4G1drK3MoV!VHm}#>SK=N z*MLa!|45mnl-Knfxx<)dOZ~H=vQIjc|8rR~obeHg(_@Jsf|h` zFI!M6(yB}w5m?}fi@}Gu4OyelQwDHIRHv<+!PuBqRIul&;_MmD%wu?p77kOMCI@Q-pE;ux|YVTRn$g zhy#+HmzfJz1(8qBd!a8BvhptxM*_6kj@c01FAI`O^mOGh=( z6_ORI9SBgCd0c-y@+o_HdO8z!tqcKl)F{tA+v|;hN>5wmr#Cf(QF4?gx-GT*5JjCGFj2j>- zyfHSjD3dR<8J?ev&B_oC5g{(c%>b*&)yNVqW<8RE0lu*6JBX1E`P)keY#WdJk{zh{ zjO^Ap!7GO$hky_eFPuD6rvqp@NL4vk{xz~ac!S_JgfvhLCB&O7jI*54I1g3DF`UKp zCv1CRQa95uF=Z+A*9w1B$yYn_nMCr*(|cbF9#f-qMH*tBBpoZq73(VBf{a#WQWKoy z?&Z)8ZPa}`8q6O_pdUrqesoaKbmjZ{i@dyG`!Hy+;1OY(B{}<1CF$~U35dj0YN0Z1 zbEiUO5P3Nrz-O%@L_(o54GbbOlcUChbrdpGuLQ)nB0sU&1&TNwo&+)wIHNA1MhgUN zM@GmVi=pYYPWl*{-i-(ya$?(pLa${+D|$O(XcPv;gpl0??anN=wzqUJf6ylx(;{RU zt(v}KG$j&0E*S_vTkTW?f2*A?H8Ky$0l{8c<*0;2B}*#!3&V5OXwf1%@wy4xq)3wW#(OH5Q;jX z8jdMAm|O#Qntga=pecp`8Av^#QkZVZvXz8H7(}HbzF5&4b~TUSEOmijbfpyzXlSq| zbQrxIfP)y#nE6@J1}|ax{{e%b{lj=;*opBYy7GX zsmVA`@98UD)=Y!QS%fDmGF5SRMg)+x-y5V+CP7h=5!@q6;^bs&7Ia$+DV%l}U-GmYMu{IW%N(Bza(Kth@*a!D<{<$x}c*{^kh?j%ZraJQYC1 zEKIX&NG`KR>z=wGxxMD?*Yv~5z?i_rndadxQ>Bb}WbeC&G(ITtX@4Z(ZI1}Q6ML&U z_C<;u7n?L{D>8sKZF^m_8wUyXTYd#2%|M#7yKF~`^ONL&v?&og2PxK z5fEFC+NRNlmvqV(7-j=5=>V>>uA|OVXe`O-ma0VE=Bu|U4TSB-q_L>wZ{8$5LA@U3 zTHTu28)hzJsmN3!=}tGh6ssCx$FAClQ-+BF)Z#i<9%!1;KEKp$yCfYwFpjWu&?P;_ z*$;&=Pag13NNGjI782UByWrn?Fh;a#+g+LPFhAJzH_%&DyW-&s?cuO4Zi`s-Avy8G zG`|~37PBfeMH!|x0+uP9!|W$Yd_kMS5Un#A0gPDSEK$ntZDw##jI4r95i_#<5?-Qe zYU-tK`^Lm(lDM_r3VGKOP-3EmaC^dYi(yCX^%tnhtJU#x9~|&xn~EO6^0BQSvE(cy@uGA3QZS#LqvMW`hLo1O7Tl>~{Z%CxMK1&M@vh+67tStTo0 zQ4dwNnC{Ffwa2zj5acBM zaT0aeq}dZJb)}31W|l-$MImdZ1WL%=Sj~S6EO-?osl&uwYRRd(`j|UYi<_UNKEK`S z&CPlXy{}zT=*Kpu$RqAG>}kW|hkRZZc+|bBbsa^ol~!2)IM_ooZKgN9(l?XBD}5k9 zl3(2x#|?N>!~x3pm0tcvXC4W3zbckb^7CWrHsDnkhMoVhN-=&5WlLZ}R0+ypldvq+ zEbq1008!H7E#in4x&Q^6G{PC^KaO}WY*MTEh>|q>kYb1{?Id=N?MSSlO@eq8l&&!Z zbm86@V+;E6@>{g zfb=n}pkAFH`h1=BjUUyidloCYo$7I)*~t(R9|!6shm52$fUBXcLk% z&5P87RbD4Klwa_$E7Fx__wXMfjs8>EO~9|7@Jr$rN`w|UK~h2*xd-;66Si}Vp#)_0 zj3N0%GJAgHM}6t@ZTIY&S>i>|p32 zB_W-csoSs+180)|#qYaCTG0mD1o72Y754s^TG-ky`>l&9pZ{J$mp`EA+Bj)%FRAh# zvWFyLDP^<*$skt$&bHPIaF(XkoI#=$0J>*2B>Nm*yD#1s%P%^+A@;9w`DR!HUDsN| z&#-7pQ%ZebVIAHv-zK7F#O5fv?RW<=Zwca+?4qQlUsyOq5glq#>j-#czfr9Onvpp0 zN$^J^FRfhrM-e&m^azy*x0Pa{V`tuSsW!ZjYT&iu2Au;TOa(+a3Y~KCv9L;{M3yi3 zic}%GykA6!PyWlAR^eE?678ZFJD5Zji%goT%RdJ;p3 zPWo!PcsH8r>A(nkk(PKcm$p}#_5S{?LfX(+{)C{jV^Po?<%+Di%ip1KU&Ou~XwzPB zJr>~=yXO>ODL>s=l5LYdzAEkoavz(CeZjc#VJ4-gM`;N(Fqfk(#6tT!ITm|rYx;feh=7S2y>z}J*{bMPTHZv2l*+#gkW^x}o2vU6;a_-h z@^6Hk_YC}C@_M|ORYHCc1mu8M!pA#mVA`zjJSWW(`oBFC-?t`frYfo#Sd5W<^{i%} zd+Qkr)ngXeW&~VR3U!)Q^cH=jW|13Mh+4GsR z0EKujirvL={$FChv8`FfB=+Egvt1 ze)!pn1vU+!Rmq>w8u}7<{<#oatOZ$e-IndCHdrScArNOjF)5<4w%Wps`Bi0uDqBD4 z=xG6lJd?QxZrNMg!sf1m&Th1rXbaF@JWc)5oBA&->daCy=6qo5`?jZ}W)0XJs(y6y zR1;uZ6-Pr;*CKw%{Z*l#cOvnoJs_f((*Th_0R<8-y!HAn#%Fh*A2`;C_!_Wg&B zoF4hbHT%Bfrw_gC7K1JwIq$DGy!a=3-g(sY$i1)FN|^bxHv`T`9#fq8`HN{;6D^(A z#1&o3U0j_WS#IFoPSGN=Sa1OmPzk0eR-N{7<(0DR;_0ak+2sPQMEPP5W72-FnQmwW zvp>4HsB9?G4bZ3kja<6xR{`&F0DbexTX#ES>x%^FaR$hT!JA6?q0!aIw+~r=%g-Ob z?&j%{FWvCjn?LaDhGObBopR0OiEA#W>jJ!pr$KG@uGof1!02zJ`%h2y{rJd)p<4gx z_?&HzET{63!{77ze;>TyLu&H0k@d4q+xlhQJ@1XbNauX#+jiGuguAVZF1Y-F8*abp zGgS1__+0~M)YzghJ#yDOUV6<#&xX9FM^^0rjy;}rSh|JF$o>(Xer+~ci8FJmkw;4D z*;Dw3=9`u+EVI(%k-5!fhNaxQvf*1u$;=o$#!{LK;Nucy+o+>ba!{v>$PgNT7gBxan#@6pR*y>Ass96 z8tdV#%+>ko|I>eL!wRHPoES0wMAPt#-1)5=S`f(uY@zT9@szz%M_C~~5X*y%z*(TIL`2ct ziNbTnm?VTqc$SF8;%Ux-auibHKr9DZ42@Rv-__t}f4eLlpQdkqryqML^wkil8LKl-%g612TeITXK1@!T|?=D)6Fuk`$c zhAbvGL8xI}<^M4Q44Q1~@aBV)JrE>fx}d0Fy{g%byXpe6E17nx&e+ZTd`2sh-LB>p z(HNhxga=T~e^8CR3w$zc7Iwk72%RQ{AqXR(nshC+$q=8eV6;%9LY*-#H^R(C&zc&k zRfWRtr-p>JFf~|iBRP>+C?SZyIW+)XPHLMPdi8bE9$mqNX|PAQwF_U|Pc$xwIs1Uz zf_B`TTsaE+&`K@1eS3b=>3rGNaHq`4ZE4o#;V~;b5wWAp);PbePQ;w_A7$NS{e2-r zqe>8Niuf4cNqD`cGU#rF+Hg&tIkXUqv{5!B6Vfa=liFKeB_>mp-I{>DWC*u;U!+lR z=J-aQAfW^d-Sc$*5pL&ns&_LD)2FQSCE zN8=3(z2LnXOe!Q%6`cTemB|1;6C;4G6ESpP2QxKDicwMkuY{Y?e4PNyBpLFia0FhN zE*b!pNhn~arSd*KN7B?AJY?6dYSCTx9jX@QyCPn#X2K}-BE;DqD4r5N;WwX9L86{M zcxgpy0C6?)+$7dGgKB=oC>vv69u&<$pbgLy3GdB{;}j$5Y=4Yp7E6YEIErD@@b>t^ z)x(R`v|NIQqmz`dP-& zXS?zfGQ0I4gXPgRuBnlMSb@|?^e2^UDyDmk(~!xxAx2$e#=rb!-hmbdmYw@ZyjD_A zZTApEXy;5+6t;(Bwg>@9#Jrop+m3nnRodYSQmn{&^fe*u86}=%4x(FBXq|xF*z&|d z3!%WTIEg`X)Z=AzkcZm1;NQb}v86TGdy zhuOkXX?V=*#nHYgE$>SY(jb2g4qbcARMX3&2mNcl^;O7`5&yP)J9n>EI3=ZXSxb?p zbw7#*hw?|0j`yeFm*ul4deuNPow=YTT;(o;jbE7dP3LKX@0%{d zn8DW|bA}PxH!XaRj{DWnbh9p77)q|cHS`{CRsAitv3zbS^c|JSuHJO@m2SFOQ2}WO z9%VysUg4&T`czS!ngXRW9Y^9P{4*60;t)#=b#6QQwGF75BO;TsaU;0NIVQ78|--a0Gvl6XE9v(cQ5B7x_Z#|rAub|wkH5dR-s zsITV-z$f`Dn)F0s9ql17C?N!Eg*?FSJ!{CY!VULmJdQNe3)mF;BD2u19{kvXIAI=k zyv3dD9Qj)+fXdMP~JogZW&=M)-9OId()ltEQS@ND_s}HW%Y37_=Hoe zEbm6yKe2onzXPvVCFMQ`eoWHuQLX8bdnSGm*LOUN4^Xaj4?P-<5A?-0D8J+^$@Yl` zzmCW7f+1Nr_z+ZPyEI51cR(|u$MnZm(K5IPU~=`+@J6b~C_BT}2|+n!Tu;Z8TF)4; z)H6XaelSmMh?+cO{5pruZHa8qV!yS=q$V3;3rA7!m1@_pc0j8!B8C#k!8eA*h}QV6 zyc5uh>`Lm&m9c_8X>Ts>pHg8$D`1MqUJV(tPgv$qte*5#WT6Wm#U;LD0yxyHv10+@ zP4dg2wRWV>oQnV@Y9PHPxSz&FneH7xFxayo`{$^(0o2?2W4|k>OR35pg0K6zlA%| z`HX7{fTd53xX1(n(4ympv%aZ0Fd9+Vexr@u`64d7Yl7t|CFLm@KEV0e*PU4Sp;*LN&IM z>Yid($ot<@=s-0K)x5wgAkDLg%&bH6Kts8>)oqRPQPKNr0aIJX6PN~u?lF+Pnw$aJ3t?|jP^Jm6^nZAllJz-eN33G^x^S8o<565Ym z#9DJ>Hwb}C0@TQ1MetxV=;b>)NJHi0B)0N8yO($Zfwiy=_%4Flu)8o5V_`96JiygF zeGr)#hT)<_EDB=ox(-+2LVNp)+2V98bLx4;*92rmpXgEc#MA9yCh7vAw6JS%^|@mI+|UR5qxoyKdC zrG9}ijCbX`^=g52zip2Q#mbok+iyXEy%jk8wA{&rONKl|k@F9CQU`P=Xicmj|2QRf z)9B2y)xLa9JorKZB5~%9?P-2%1=Bb^4X-LLHRgTMt-GrKW=%W8TMvxigct zEchsLpSV~)(fRP|))^pbvW6tGAdQ2<1Wk5+Q}AdY{^qh{&6k?({o& zOb7LHRI$gHMCql>Q~Y!64&|G=2a_vP>fa5IdBQe`0YKS+ra0g5RN_wQc9A7PA_fIM ztHnIzRxr9Pk_Gx8FJtexd;BPNkHf%3&~T-9D##nzGry*aOrK??c3}$q3^UdoGh^Wv zu!%G${{kbI{UdF7>kRUBnfTM@D3iC;PGb5Xb3uK4(+e#EZa7{ooFKLwg`z5cL_pCm z5KGg8Ovgd60RFE_b4iAt8TRB1F|Er@Iqq{!FtP%v%;!d;u|}$2R2Ju#*3CQ)AK>J? z{Ubu`6v)n;^!XTtQDi!k6Kn?(?N{^LD-Vi)Dk{(>uwizHzlG36Ig^L zG^NX87DPR{9*zyQ*hA8BpasWKBst4sWjF;?Fj>3SwyXnahij?pehF)QFVra-3#l_> zweAvnC7_uLj^G}*5UztjHV-y-z8M2>vC*@9nKA{lq_8MBPW})H2APlUs2U^_fs=6F zGT?NpJwBU=KHVhCkf_lOd&5Mg<44R{#2`uwsrBN4WK7jN%+mA@6A%UPP0(xEKRCV% zj4lO8!xrl~uXf?F^gS)Qw}8t<-UFa`EJG=Y$!X7qf;&B>Vs3&fm4ONDsu&X0Xm}UU zGPlSgonEkFg0~rxK6k@ok1 z@C_PSLa4jyZh68Y5V@|nZ$B8pnpiL7%z=!QKFE+R$Z&nt^80YfSo087gabs^=r196 zBR`P6xq~_*epNTWV)kjWGqeo5b6_1q!LDAioLsxmOoq*6Chj7POri|t7VQ43rPb6+3AjkV(3OcJ9^Y#1KIGv!s=!ZURaKUbb z#9hnxCL%V*U~CuXv${KLMq45^uH?Oz)p5Ms1b)A6VfIVBZbz|@=3{iLE&%KG-KVoF?22~ zZw4#x^UdCgb83y8ww4aP$?}$8~*7^(eOlwXI}z%Ji(Vc3=8H=3s`kBN3f zLZ`my$?CbkRNWFlYWcO6O9CijaDr{*IKn#BovTcF-#O& zOkbiLEifoW2q)kOfake&=f_m?GA~7>`RT#s)DEcCOH4;>yBpyu_rWXRURrH$L2p@8 zW2H&_IHfrocS8s5OVRU@JtmkPsk>+rjY#Z7(d@?9YdS~hBo7ChJ)4?B@_%iON1qc# z7v&#IXKvn6b!gVS?`u&VFcPMi?aIl|(j;b5dk_@*Sz+s_xWXw^9dIw)jvIgVM8Z2=XQKFr*40{D5 zYwQfg#Lkky;KlFA&VMucj+zp;OMXoy8dG1_p*BS$t2-Gb%rM$(ir$ZSEr4cTLE16=&aeSq5faQzcj7H%(A#hz67Z# zHr>M&Hedwjwn%DwbYYn^BAmZY5McSv=9ZIe+ikCcqCIWM!$Ta4uebD@;RCV)R;Se) z3h2P~wm;1rK%N_TZi%{@QMK|FFb;2Z)D^5*$VqA zvtM=l(+Fh;t|EF71A#w{FQ#cDn5g{3<@fyG@Cu-SxJ9a++S140)^Tz6~fXP(NOX1lLP z_%dXBgkxvKJRoyrmCfQ!G<@Z(OY$Ek4eTr|Za^icI;fE2i^CGppm%r3T(X8>=th=w z@!7Iha)9QN<}Bc>5w^c{{OpDdiPj5WcQ0@MHb(q1I22Ic35O!ff#W#;ltb2MJe}*G zDySE`7dl+8E3hR#OoB0m_5!zVq;@0Ln7cw~AYkQeg+5t|nDSO?x9S>J9w>PEz3jW9 zK;oR5Msxv|t2GA5dtRq%q+qPLL5e;}H8tp$ z#>>XxREwHA6*%KmWJ6>XTphrC*@%J=nK)BiL_lu0^B*X~y@lAciHdNYTHR8X&|hQ| z3Axr5BWSHr6wlQ`w96IQ#uoW2Y(j(nip8IZr~P;dmjP>oI?SjUjnzS(kY;uV7>{5Y z`vk*>C6kCV+cd*;)y^?bJ*LL?+DQE)bVqd|#$NNscP{ZSDB=#uh}Mq73aTk!$>G)4 zL*!J@os@PSCa_&x!0^ZRG8ZCSpoQP+5w3DY_PIh9P8CgA1j>co)&>)ttjx?T>*Zk!IdwNT#PVZb*A>S z&EhvzpUf56p)S!nfdLc=jvXA?#)p__OAET~JyzOJnpi1Og&ow54AtAT{N_|GJm<$! z36He{R-Eb9$2%0c`7~&w{KZsX`_NXkP>gt+Q@_EMQn2B`%Lj zNiN$fc>Es&nT*Yg#@s@kb;)VsMF4x>Q9cb2NW!>y%Fg@l zv3v_j6Es%Zog;E&Qnz4!3AOrqTet3yCtM*VO^-yf8cx<1iL-DT(=|LrW~-Q&`;W*8=@3_SFi%os2i0RS}KwPC*G&d|_177yF$> z*OZW-L&9e=j~X>(k&%n8t(lt>I}5_wNi9%Y4I>9}mZphIo$8q;w2&kvM}c&IGiXr3 zqY55%Lk81l?%yG?0!o(wC#YL! zeg?rdEVVLiSr}j?d%b0YNEpKW;FiuE3QD(z;5-*j-B#hXo@1a=6buM-4;!eh+&BIq zh6jy3r|FgLv7)5e^YjX+*P&B#qJ@WM@7Da+vz3;CZ<9UJ=}*n@&S)!Gh+=sIL$E(m zr--mCSgev}zrBWuE7mBNe>Qq(tt_RzEOc^+?j2PIU_*7j{c@ku5cZDD7qB4$Kc%=QNm4-{*E`im2W1 zHzuus>x2@cI zqp~soHd{qBHckq4ta%qfzkZ(q-|7eVykh2$F@d(eDI?4dlTZi4_^@xyP=!C){M6f? zpWBMhGRHh-(NZAW+-whxu7I~l3pei!m}q)0wAH`PnW9;x{HH}Kb6@J`3NXn?60l{_hQcHQ z3t#4SrDco8k}w0}^$Qh|_h{Tk+7@P#^hHcX>#8rr9`7t$0-_T2U~)2K3F3-4l`xK$ zl156CGH?&tCIXvHiTlQ$pam144cKg<4ya%ZsB`(9I`zsDju}e@r;(e#3c<$CdRIZ6 zuO*9?M%a*UlI8+MHO{yF8EEy{&EQ<2mB_2A9^B|Hp>42{0xfjY_&i5Wlw4!1* zd#m|nH4{)UdkU37M5y@SPJ!UX)d`ryyTLdEgfW7qK_Nl5y|%Ilx_9+wr;d7Z8CAbyBj7hnUufK%)NGDoI|JS4Qa*qA_eq@OyVd>eHt;Gz)B-;T#t z5q(S)A{dv54D{x)*Tef+Iao&m=>u8^gaDyh&% zagqN8DCM=WoNacBgcf6phtW0d$|pgPON_-tdiA0SMgZ8e?Wr>KPLDTdPCYF%Ux%{ceOerF=^{2q#IhNjL zzS9A*Ky!5kFQ6>Gz9Nn+Vj6X`jTY@kwW2f(FX^ z8w9)r0Hw+5HNLQ^x6th~4DDi+RxzV_5lvIG-CNZFGHTg-C4iJ)Sp(J2?AudvnXKhb=<#Rq$Agy6Rkhu!56HVZeMZtrN4XZ z)&*yMIA)`3dF8QSuLH<-OBeKi@_N~NQo^kL*&`!A`lrXTPo8?zbO92k!=r7B^(*|i zXEPgg?ccp@#oaJH5{~=YJUt~D*Oxop&i`sAQ#X6Qbm3-3gcGqO2bK*E9X+j^e(<8@ z&29_qzghNj;w8FC7YSNPcOM3Kq9LQg+;iOBZ)Q(B&qo`|{nyR7^|<%kFpF8m#pAy` zfNV){)^0VWS0}f#&&=!*ydV-++DkXN`=~ajgl!XST+jSwbrz`}_vk!5Y*sfkYbA0P z7uBM|hV?qm zAdGDP_#5y0k2CMnW%@k*`w5p*&1xt5r|~r+H%-%GwKbSsTc(OGKw;=Q%Z~gZ{>Qo7 z4m|1>m5z$qh7BW6rib0%edn*)W3FNDahDnbeFxP2ZT66Ari$JhXSPgdi^>KKzqY=` z5U%*Zo1h8q0#IBeMmu0;x*0=-aPy5euwv>PJprtndYKw~|jKf%g9Oh$*0q zH@up~OpJt5k13kPOHa#{k1-}id?9GV<`^wU_$(~M-P>dEgM_a>;|;JpLDJ`(!k^puWzr9om2FT z8x?Gzk2hC~*CFbV;Ko{7v zzma=Bbj!pWUhrBr@Be1(o4320zrY^+k^O$S_oqf*G+Tsm#m%>{rT?{?xjd@1lO9;W ze<0sz%ha{htM=0kFhClf0*=W3v2)%A#-=BW7jlUq!W0$kyH8pW{OmFh1ZSm_3378b zZNes8YNxEp?zcEvo3~|OsgoR|x;9ze(#f5o^~kS9z8OL>j4s-Vv)ILNj!`RwQ=9ax z>>0H}Ag9c(h3LB!@rAv}mR*bepv!p3&sKIVoiD^BVGJ1gSP8a}qlIh4d0~Z5L|U|L zO>;cfh@ZsD$fAl29p~4?J8Bw!mE=9RQ8J_|e6ci40s9J$TY!HG$W`~2W!(4uoza!I zEVIR~vJq`1|3%UW+ih$eOWcQ)1S^UYCIjcetkR?a@Z-$3%c>*Z2sV_lK5N8+zU-gD z=}`SwlCFdlWJr4}CMe4%QPDtP_Xog=wN!PhB=Wvx={P0dqRUl;KpW0XDI-x>H&O%+ z=#VH3B&eVy3mScRN7ZtTJcX*z4%GqSl$eRDHF%{B-zCJ%-w>rxQ3|siRaI+A17Loa zR7GZ1h?|?GeF!Y?1pDV84D)0s_&)~$OmHCHLNAEFsGvVfW-q`VBnq)ewyJxxDD2JQ zl))Kg?|w?zRVurRGk~HUs=dBl)C?&e{@@@Pdgy{!YwJ;kM~onkS|Tc> z-9a2gC%)RFkE_>m1#Y=|m02Zp^&0Jr(A4WpPuwPYg#y&AO-qF4Q_T59Xr+NDt57^U zli&rkOAZf(0^o0&%9bjR6)^w9PR2w?5LFTyCnZla=NI}=lF_FOAQf6MXn|p_W}l1g z9AFz3Z6>1A>{FX38&Cy;piQaW=%Z4}SrpN}c~!;izhyJ7P~J39Dwj&cAWL+x^WmGm zquwsiwW9?MvpvbH4Qi>Tiq!%r+j~ZzqzqwUb7TSXm!>TtU1^wwD1)0Ln_s|SU@VJH zAwbE`vTc#<0xEJ2(yX?C|(HvOstqiq=CbteqJD80%J)eJGLHNQasOkewz?4=sF_!3UCLNDulgx{@o>Pi)aPJLtp4-oNLMrshSR zPPZ*Q?|h#am9mC8tJv!L)Ec%gC=1M6#ST zR7^%QnfV>9l(#XT>JE^VcVci|7NkSv?NG4%8A=t=Se890`&BZeKbc~b5m+2`wE_{C zD2L#s;x_roHFm(kEo5N64x(+o7GnCe48cui34%(nwlpnLvTD@H@bR+dIP?e2Y6TJ1 zb`%b0u$AReTjXNKaHA%O3(?6r-V}uWkR5H_e#SFzDOIUKs6tlQL7tMiTt=5N3-OP4 za~D0=Tz4P&uqT*5ly~+qF#;p2I&Gnz5uOXh!(D+X+h$jx6(P<}XmJ|mw*^4kM2z#x zF)3L=btstm?L3^|Y@QJ2G|**qo9NRo62DHg?G51bMwg8M#USvV#km!pvvv8*9G5*H zmhfDY#M~Zm`8u2nj;_?@tX{A=JkAkATB{84nYy|1-Vh%5rC3qKGHmhV9tk*XYjI?K zD|&Qj67E<+Tx7#%eSl9KWV=S|ptMy`XDozLqKO%`lTcjezWTZu!U#W=;DObfFP!Wc z!IO<&TkZ&DJF3Ianyd*q*L*2n6nK|npu}p3z0Slw3v(mj+ULS-k5;@@y}{Z25xLhRUZ5g{mCIW|SbK09;Am4kSavTV>}x7M_1@}a zwZM>bP3qqVzcKZz#mc_d3ZHvy^IC|k)PlCRROd%GzoM@qM)j2ZdkaX=&Gh+7eYpaa z4B7X5?^8dgp1ziGP=9^ay_zYR^)cE@I#e?KEJ52mwSlz} zOVng#1vwh74fi7!XWe~Y<#?UU)ymYTn{dFLXXTyOoDf1x|K>5_+x0aG66t>`;X60;BTY*)6tWtwoCB@pPOXgu$6xG)?>l}qvB>Y-Hu5*D`)Rqm< zWKlg!{0XsvSCSLCb%rJgkI&YPv4+Aid5=s-O}s;rK4bUbx9repofyrnZT?r$wPyA3 zg7tcv7gxH;@A#9YE1WF7=lX0TYh^qJWXy_V27H`$LaY1-Pt{~7g(u2OObL)@J_qmT zVLeq;AZ839hUhX@IdZ8Dn9nnK%dBK<2gvB|D9 zET!(P<4evq;W7n~ww}XQi~bYn3MuYd z#WAL*W72P`oVl%SOVyPP$Nf0NZ0yb&Zd1DAx$D79csgqd-C#hO{;k8#vpEq9cZZ&5TK=T1L5j9$V6n| zPuU;o8W|U5&%w%Bw<8&=MW0AF^*;<-Mg17fjDT@mXFYBK-XTe_yu3=Xrp*WIbC+*g ztgC#X*K#znw}mv$O1(m(;E-}KzTP6o{l#QL_0c4%9!pC`WKcUw+A8IbsaWr;#VkDx zn2k|Fe~UvNwo(-_jUkKEH#7tbj)4%GVvgdB;#d}|D^e+nWXxzKSvd|YP&M;Lw8Ev0uCW!SmrhBT%VfD;HGhC**yWyFwr8!^zPf)yD_``2(q z_+y7e=c&#>;$btEqfeHEIxc2^N8%zmG0*lPvDGa$r^HE^t|)zDN>O1c0JQ58)>9>h zR@#_q=~~HwajFOv&KCp*V6sEiP(Rp4M=6eMW$ac?gp%8tzGg&89ZU?0pdBYGtZ*b&{Dq0c)tdIHtTfq`X+93xsHLaTpK;nB@PVu|Yid z!ZQ(a-Y4$^3KUXff;*|^REh|+9Ut2s!7?mIDzL!pO(AeinVobg%HX`02RHw3X1hoB zmd2SK(^4C;X-Hbq7*?Rh!qP^70fvZ?_|>NwRc#=)Wl4NO%euq`Z_vozA17#?$N)}@ zvB@z=4kq*^;2w$&VI!E1I8aJag$OfH3ddj-wKdH;Vnnh6ljPd)PxUfbBPWD3SuSHT zoQKNtL_cgSL z8WbAHJ`|_y{IiXzH#d{=bS;F4Pj?+(Sq*$o*3IHM5`}-n%;0X0t`2_RC|Y#%RCu`P zwkhlh%{ctrw)oYaF3RU*gbXOh8{2Z+ZrdzhHp^dl4PPyBukTY26e&}c6jFHgid*ys zi3vPh9<#iP%|3!4mJu*&hppO7>$2FN^5`SG<+s-oOqtlvc1ScPh3LgWv%=EGa==!~ z{1Sv<+l&E|DWiB1RN*7oB+(eMjg_>zCSG0gNs@;qngS#`7mxg!^krot#iX{n$dp60 zXJ(4a^KBO3=#OLrtl+6&)eQ(>X<~jO;qb*8(bG!$XV3|~JhS*>yS$L+&FXn}y_VhKBv@a=N*WJ;`Hw%0 zDW_O%ir)D44Qt3(teb0xKi#h?t2khkKJ!ct)~T!>uAd*a%GYTBit2edMWPp0)(o#@ z4lYSP zZL9BfSDkxCfxv=QOtG)S_(4E@Z8(!Z1CFwh6|>BFO8v}?;rQeMdZ_azYEnW8068=r z(p>!9q3I!fM>igtF54FI_$KbKsD56)3rLUhBEdS*vRvjawlPu*t5GM} zOUdqiFEWN4p@|RAhJUhK3VVWEzn;8o5zZY&8;R`PV;5K56a2q)ebrsRzMA*Bb^b~c z!z7nH&?Rp=c|2e)!#}I9ZAKfpV4-J1kpDtjf!^ZMN9eo3(5+)yVSrTn#Q^aLN(Nb0xHQca+}z@SS2^dGi(URhshDhGQ9M^gqg;` zwo@4uy&LnTp0yLzmOm6XVzAxY$!Z^6qi7PABBf>6U67$T&a-!m5A{N*30_U+0qMmuOb1#dnS_wA~JOZw*Y?rP68PU;}$o{)EuUyu1bT<${7 zx>nkeT|zbahH9U3o+<06b-*ka=v{V4AIu`XK702l90c87LWB+5$*K-=&JlJOL=}+- zw^au>^L^4uDr14y2U-2{#}exj3{42LqU<1^BQV_agj#hb2STo{N&05{3}cB_ZAC+? zmi*^2B}9>|iBbN+w6CATH4I;~xJPP6OHK#+`uN$ADJ@JJ-We!M0GI3L1#JxH1=ZQZ zPwm!beAGoHBeip^BaQ^>=4t!>EhIscJ%}gz zlXrg}lMkSNW)#+=UAuspi|ECy00qOCc~<~V9E3yc`5fXbh-8RmL4|?El1By>wbAnc z%3}q}-=I$+m(Oo0iy1nQa*Mr*-%1^3pMkLFibes6D0W#tlxxR^YSOY-S?ZF6mB{aU zE{8~+*aI``URHCHg(4&rl(M6)D8*$V{WI|@3gO~TE?Rnrh>6)ltrIjd20{{rh^5%l z*nw}7E5QzsO@(HCGps>?yz|^@)-zQZlW1x{6B5njlH_)S9|@~86G+YG60 zQNEWY?Awt8rzN;*ggLQM$&yLM2~o%DJXpa*X1ejNeYyK40+|s*F8YfDn#zud3Is7| zf&>}M0C-ela26O$jWFgI7Iy@WxuxNx$uJx?lCYsnhXdJapn>%jA7E32-#v8yiB=xy z_q@&XeGQh0epzXOC0~T#`(sKfxwyd((SW#_5t2RinHC!z_}7b? zwa^m?u8M!~UL*!!#uv>$h^V}!$0Y#ZO=fb6F7+P4xJ=F}wm?auXpMh}{dX}cJ%H4F?hJk5u2|w&EeGC7i?+;~;_*d)%GMP@neqBdPQ2^GLheIs9j@0!w{QqBS#F z%+RE4CUxu%2rH6U3Ut#jT_$!PmpH*F_~Bz3%7fyE%+3~Y2gwu~xkv8uw81#2H$^Ey zJ zmZVhC?pNUGYG|jx`Q_RJ*J3eRfXSv9LEXM_&~NTAqt}XbP>}T03R^4+Hk*GuHg0R& zfJ{X0AY=6&8VP&QwlO)Hv1m_3DWMqs(&71#lm=U{zL}CCyzz@13zlA9U0f#zLTi8+ zg!TZDW+>8}l2vjkdqr=L(U@pai{TxyON5bCWMJdb7JX}OA4xZoP(t(f9c(NLIBP)!@GHg}kS#g{BfTe{u%862m{kV$ zsu*Q_GbR_QeP1mi5%)yC{$9S+OB%v`OU|IEuMh!DYl_Ja$R6UYEqdsZ&>>by8HOH4 z9|Q|tg*8bY>4ZltwZbj426&FitiJ{BND{L&h8I@cbJY6^BPErlVl2^Q-Fb%4XO%#M z!KFEgb6Kx#ae6K^$F%fw!Ij16q`K-CwUBq1jMjRsW3cikEGdtw)HHW9n^GOtj(Hl4 z!G?tLv@)Y60Z^ixo_aDeQu=#4sr1A)CS(zu8=5s{^PHIvj0^*jg1sa*4~f&V-SPV0 z*K@0Xhc~UihW6&nD(wLTY^?;nh=~T7jo2e|+%fK2+JjyE{8*vGnouGyj@U5nic;&P zhQh0?LuCfmnCiZ6gP*XnD7=B>%O?9+_5h{OK z?CL(9KAFX~#-!6vy=_Mw8o7nEc9Wv{~Ob3(C%DusoTO{lzfahfY zD~_usLJc)peAnAyHWZQjGZh1(Z@eOLQ1gQ#t5LQBH;t-PM-LD*?o zy%lL=CPE9-+~FxEwD4G}VdUPkw>X-*C9vKd<0%usKqS{wswF9McZuyCVF~}r{!@>g zTeOaJ$8wqGuT;7Krd)X2_kO+ooYWB5sYP;rVPVymB5~-D&M4xJc~9Ns8XaxmYe3P? zvaleG^XE3btibMpW z>3TxvB@PLPkXVUV3+})|%#rH=E|HsKsWB0gMg%NUtP9I8=mo1rxkZr57iyZ(+&7bE z#K=mAt*C^KaMJPZ_JStKWulI9o(@UjLAV7ZEx!Digt#oGLd$Q}-DytSs{5LjUP#iG zS_Xop+eAptE7}F2TEr2>W7xNwObQ7Y96zHsq}nJJKfFl{ru*q3w*TNRG^5QI*#3hT zhlp;3NA1B0NnpVcog}CP)Bp);J3SP}*qsN)$UXphipgk09)v8RR4EBWo}#}>_QR^} z@KI;^>(DgNE^($a0EpnF;)NcJu}$1Xb?~7hf6VSc0%cSQ)uG!;$~8zbmr5K5F~5rp zDYGj4R#;epEIxn}nwN#48X5+QItOA%FI4xc;@v=uKzqt^D92g)%1-X4oQhT- zA8jnjnMTN7x`fqv0`<&nyNW75Y#I2be<)ofcBHxr8mb=@nvvZ-iEUvs#A6!fKqwL; z%E-ZSORTm+yzJuLPqlOl3`}?3N;6tS2jPWb^0CYAo@DkSl96}5pdFN^dn-u)NDZyp z>$Yu|PuZP^yQZ1}*7Lm0qxwazNT*eWfiGs#K4b zT5Pe#R&VhI-|s)hT6^zv@@V^g31siR)_jaP=9uF(#~iaEn*&yr>7e89?7(tFw=qx$ zM^AvNnVNviYiZBYfJ}SN7&2_tJUFTcQBYJirlJ73vdk8;EOh^7B}5SKanGHk2(DE4 z4=W8NRZNYVTl4Q2M|D`FZJQr4VitHLfA@!Rf6Ag6sGg{$t5{}yTu~;5pW@7917G7a zNhQhd(a1URX8(D)e_TqZ7I6b(P~Xz*#VQKPRxl-pHbrKm>u&dMiP?l7FdE;>ZQ_s{s2TCvRi z^#y7%TydqvGaL71EChijwwlH0v{6VX!ac_5n&BaAbcLop3Hu_r0IpV&UBXXl+7Dh! zYIBXQ^Wj(_nOXiLwv7-cK(M3upC?nj%AL}Z)1K~l;Vf2@b7x}rz4gr@v2~-WnM4i} zgHGWO-628O06KBM2GEHT8#FIkX@oJ@2ogmho&@`uWye^?C@d=i?VOdWWzO0*S;9Fs z1_3ewnd;iY{YzulbyyM(qfNL9RLV?%JiP5W#;)J>!#Mo*^DX{`ql-oc3@K);1VFzo z@&Pg`Saw`3kMJS%7?~w^pvTy#X}tJvV&nc3^G<5aokst)WeCH7Hgz0hhXi@#OBm4( z?Gr{(=@4@X9)z9_@u9T?It0cmkUdoCP!H1gu=P8jLr{Cjx}Gx)>LD12wvAt2gZ=Era< z(RzhMHKn$J5=pRFKSn|#y@chS|FD+K)Hdaqf6uAh<186CRuWDyp*oRFGO4Dxf90E6 zOLpW46i-SlGCB?lF$QUTEyx2Oiilc{86y-Ilwhb9p<*@_Igt>Nf^wFa3Cw8nSO!>YY`tJ|5EA#SoEtfs ztMx-YUB}kH>rWg)yK5|lp$k-P{T6&%6hnql@Mrw6d=wre-;ngypFvPn`xvZEu$UBo zp1>5$dv2-)G$d!xBZKYn#69a---$1vh&N1%C>Jd(XJh(CA3y2N>FXs zZsYHH#g~j>03Yn@5!pY)J%9;hhne7+-DadmBl?FRYhLOffB~GpHy@eTl_aI(`@uW+ z%!sothC=$skl++jpp+3ZR1K+Twp$<` z{iRR4&?QNv6UE-|@Vcr)pszyf!>}K2PSK#qW>XTXFZ3|1>7WA|M60|S$>CRqu=Jn| z!7M=FSYN>xraeNfd~OF3y}J_1wITXJL3+{(iomjdj0kE4^a}NfS^fFLt+=S77VC_d zNpX5NS)_KMYjULo?dwB2J);y25C}#W9)`%-5FKkI>JXO8;Y_cfB$9p3(%_LE7sT8X-^@}F>lIPKK$=*F#249z6jjbZE<;FuPSOUT zQ1E%Ew!3Y`kVl#d)`XNd50K@U=leH0Vi@ZyLbea5?j|JvKBa)Aq^85MfVsX zUaDJAPU)Vl8HBnmi+Q}HTq;3D{pl(S88tu!OP$9kQ9(vxF88s1 z2*?*Y{o z)FU*)*^i6D47JRwF9w>2uXm@zvW*DY8NMuar+OYv+02vAWt%sJTic?Q}eYX$x2{TL}Kem z6N0Hr^sGKdd2Q3=^yrlD)CMiKb=HB66IOU{856GJYgo#GX(hVt6jh;vw%l}2-gy4= zI#NjdB7d&ZW~pD95{E}%M(_qgn5y;NP3;Tm4j=~mijAekF5R0I_(It$`#2aLmaem$ z74T>h?--9RV}ncTEIOEgh%BBzk;6#ij*3t7Z{j@uep&L#^l#BfEL6m z6ajsLEspRMoZ{0%&E2p;WZ?ncq&>L!fYWXmBnSyn_oyF0KCI_Qz{A9J#5JB zYRDE{5V2ash>is6W!kIn0Z6IjNt+YnfRU~S4l3WJuMSMWq1LQG{K)O}uV>^p=< z$*PJ?>bV5Y=<{JB^-^S`%~A<7F%A5&L*Pdevx<6c^g@~CQb~<~i5tIZJQ?m?mNgCu zkIP{Tp6&1T{#jN_i<@$)7rd6798+pxu6HG4Q<_LKDMDwO2kAz>>C$SL!kEzD>(J4b zQm-6irGR`!;EQsp?dC)1XZO}|kLtK8#S7gMAO2G6f|Xn?)3!v(AtOtONq~vk^Pa5A zeR3$OiTEo*RnqG0DR`xMLq){+${rDiV!v}!|RvbvWZ7bDZr$l#a6|L^H zs!wlbHEI4@w)TK}p!ureo*jyq%=Yya5%U6i zZ1&Xdin+weq3VIl8nVz7T*0Q@?7UCO%dv8{JC@~Z##glP&%ow_e z#_vTHc@_CN^~nlhnvz(&$)ezlgYOSlr1N8+%k$ zEBMOxv(XW;-W$c6;;vIeZ$Ou^f9Q+0O%4Ox4(2o=&Ox=N@cOCdR8;(z!z;ER3&SBf z%o~4jZ#Dm(q3XK+xgN`5E_aK_>g=l2K>s7Wh=C5Rrg(SO@p4PK+|8M5chtVf4~V6u zU~&g{wSndWucWdUTYcFIWau7}@Dlk17Y1j#nC@?)&X_erEzPbGl(*9(DCFV7a=1nZ z>k-l4r#2&l#3+-a;5DcfWRk4@%yThuk=!69nw&&NE`c7t%-w=jZJd}jh}Dc}%y4Ch zq6tyJjzttd5>YTQoZ$9Uc%an?Lqbf10o(75752{oTfrmbb9NA(Z&cumY+x3^zV+T) zzDr8!p#waK2L20lxIpAxrdS7?Jra~Ld%gEn9Iz=F9_p;Yj2M;MFhrj|)eoXPFKX4` z9mdD2=)yh?+tF$3^93h1&yvO-jj_Y)}3BJxNhiWet!aPs`a~kq4>58 zTK*o3N97jGw{aId)C&A%Vd)z}g-$B~$9O8l(?1aC#yh?+zn^Ysy~`gU(+2e0zqqgY z-m-t&_AirzOswZ01HSsI!{;S&ZxtsLrwGJ6*&#+~Dv)*J^&CUUH;o;K@tZ}N{oy`2 zea5!v(gFslYG7?tHa?OIlQTs#yy4X*RKdtnApw{j{Jh81djslm_iBLV7Wp@EgJnkS_P9&svHX2V(;cxC%hJyj zaFpT9bh)tOf2;BQ>MLQjF1UJE1s=TqvWnD+x;GQUabo!i{VQHzrY8;WMR8!5wPfqB z7U&ae$;1R?4`ETHr}OR>HJ54VNiI<%aF zeY_sl_8cu)1E>vjk`@<`w?K?*;Caodo1&10+aYQGfi!7w+RW!>sGlGXYp6OX^S`14q}lX!~Vq(hd{e}n$zh~OL9E$fMrP}Qj~#Bt62d$Yv?JOXqUTsXju zdz~_M{Z8!)!9orJUx0koB#F@s`TS)0U!?K)4tAPh0MlKV)qzY6QmVq)JkWj!FvQnrQyNq#C5=AA*)LszQy|^eSyB$^d=|~p zN*n4_r+A^XeS#W5+~G3p@Fr=dIGlY^tK409fcy!_0Bk%J%Qt)T?9D(*-a$)40ev{_r};`cG4PHlBAUnDcs>iqhpS=B zE*TDg8ykJgQ$Jk0VsP_F##BUTQ4w4kRgPssvSvZyVz+wvW|4bYT9Rc44 z?aoY-$ZJiqLBAt@x3?IBit+Q(v)lQKw-6Olcs2a5Y*innZq2toR4= zXbt{_nM5Xm6p`=Dgq?#n=c};W^(RRq5#B!5f_=h7cQ^SVy?S5x%JR*8mld|}Zatz6 z+n$TdV;W0|_bnQ`sxXDZe7;-mV}jqc>Uep>=hBTbeXExeFh{ zd7&ey7;6mD4xu^&YKQ@qxiVDJ^_|_;_G&fKYT>73-)~M<**{dywEYlWT%Cu-_Xk7L z#^Hy#&P%K@)-`C9(Eqx81V&~CIPA!LEdwlNk?F8-b;G2%fVW!LrI_9@OZdGQ={g>k zpv&-#>lB=Iw6|kY2`8L9`ff+}FM z&^7kIimFlg@MDp5AB~CJ9o3lRq^~le#QAfy9G%&F^LBPxe5zjA26get zEI-r2?`prDB#iEplJo624w=d&N~D4C$KAGnn3_`$uYQ@|Oxy}#S=( zfrTfnSFokh78=D}=Fb!9iRMNWR1odwYAh#|=mLq($_>M9-phs2p#b;p5mSW2MO0mabfBOXb25bIB0WK9a2+LWMWZ=rASNyCDZkdahVKu zCwvisfqOfXt*Q@hZq?=xm!4|>;}nG~LT#+*|HFM%ZFLF+>&rIIGQBW_2}xa3>yU3H z{1U-#(#5c%xBgRUu1wT~h+eZi?7rRef_!{wxQp|292n;fT8DY@O#$Tg6woY*5SODH zXjW@aKai_j6n^Ta?l>vg*uQx(dNYlKq4snKQy#(J!TKp1(;e=!q+`3xkx$ZgXfr{{ zE3Aj<&S(l6%EGhQ7~R-j0fh=HS&oXTbg_EzYh~+da|T+IAYe$(mR@c6DVK1|BcudZ zVU#j*0mfI)c$kN0x5$#kVuO*uN|^3lsf^UvE{ur~r#pIYE;j>LX>E?^t-?n?_KtU&yjD(u>8Yut8wKiE#%*Vp+VMk$*a&sr5l z-SPdMVWVhMdtK)IDu<|R#tIYCW|nyIpQ2+=nQ>+>SC^xb-E7d<73VHf2iU)avb8M# zi#)Mh5MD7=OY4P?wX9qv^YW+AkJ%aOCo9L0KbGf&P84diqa0W2G2q>KDTt7RwkxHf zY~nW)k$ikLLw*6vBSDH`pDgrrnoY;8IfUjx-OcOD;oYnyDMUWHwt8iEQoWKqR4h~y?JoAaj=IUYy2HMa zVF~9%_>zLCWbwMs2BX*k@+Awb5jN7$fT{tGA~670sa1#BtWAmfSn5(N+H89?4EI-GjbA zn^gKm8>WSdj8X88Ou-SIaGCU!w5Rv8?IfHqW&+3dm!#~l+u1d{cf^O`o_WebHwJP|gCXtwzHsCd1}9oD)?%iHNs zjG-H&vn~U@3>Seort_KVT4Nnna8uzHKuOJlL;=W?~)krM#EC0N*_pxwqP094!1U57o z@l)2i*d~%vyj1Bdxh~z~4x|Pl<~0tOwH81A45?8nr);MZd={jzoZd~n;yI@$&W>KM z5);X%XcWgJrl&HH5b_}vO3Firr6+m1n|(Qb&e;Ckn&c)vs{n2fd)T7~0D2W4dkCU@ z2Dh*5&F0iDL_T4m57H9vxO{buPWCkwl6O!Gn_(T&Z>a`Xoe3zQBP(u?)wOiFLsgeg zT4-O<0TqJe$2`{O_w<^Mcaz4}0x)**MfGk)J!|HtRjMprayGQIUudM{#Bl|CW194R zWkN7Yp8xl1zKyJU+50^16)i`WwPBb^#GpU?x>q6%!8SMsbqa4$i2659v6#oZzng?V z`iTkm=SdN#fhc6As!`SwOF{)bH4RqEaS!G_&)<=gD9OX@#SsVpY7(AfC|FIP0*lj*K917YhS$ zZpDc_4NH%*%8>!G^~{Baiuz9((pEEUXGN$0ti>+ia1LLgKCMt+@d8!_`k*2!7{7!g zEMlD^sB0ewVH0GxwV-OH;x(Gtg=o)~9Eb0RfikAEaH;rOIKxNRcV%87TLuzX*sFJk zdqMiX0?LI~Tp99E&>o3EqHYiBOnM?uOBL2hG7zet!spMXxRMO0#U1gA6g5YFHIckV zG3wOEQ(~+X(?*x1V&L^UUI4gCzD8QOsn3-#po@v4b@8+5>iX3ya0^hA7EaR$OhM(Y zV+j>V?hv0%(1_4xD!Z~JD)tUcY-IN-NR+dT2uy6aHn8)NalV>wl3GqBm8jBW;wL_< zhG4-^?A6h*My=WUs+PqVx&L z$9Q+oG2R_@sIjF2#gQPwffS(#G~(Wzv2Z4TPCj7mSJ_fO8cm6q`kDnMx%k4rS-3*S z&Bp-!s51zvEzV(6N$A{>m6ee!7_f>EGk0bk0mhF+-D zEBH}8!-qmRBfI&lq9U~MkY2$%)))s4FXx+#zt-vT^YqUIIke@IZf+nTOb?#3iPjK? zihoQM|43Zc29L=VkX@5e##1c>Qz2O{4&5z;)5PST)GAhI8J`J1NQ`y${6;q1O7&8i z;Wf#t`9OPE&Ihq5a^NVdGc=^TB`)SCd;!?Hxt^^_UIU5B(=AiJjx9$;kwDZg0;%WQ zMty^jfs}y!r4|W5v=bMhq=+?Qm`JX*U4`OZK8AUT zKrbWa`U<>%TroowPLf2G9kN>CyR+DnCx;LId1QLS)AO8_c$0aR!goL5j;0&F-g{P6 zKvr-Tz^-;t#<^Malz|BYZxBdtQmuEB9>U!n)Mc1vmt$zmOh9a}U~;52zy(N-WtoKe z@*0X&!I=x10|hRLFWn_P2=UrxN@O1MQT&eGS|R10rBX?EpMo-bQSx>!ow(6|;t3U( zssHR39bj`06d%I@h>~RRC;?^l1^15#bz)P&fmsKqXIOX~Lt1=~r6QN0))v*%o%a0^BCb7qpCgr|vS z6>o#O23>6AS5%cC%O{wI=<5coMuV-|>Oll1@2zY;DCt@@HBYYV?ojIu^9j_C)SS%7 zm-lWviHhPMn!U}I=qmfg2xr<{kGePP)<-v<#qx`9V+-kKdyLky$G=3gv+|Jb)!N_7 z<9oc?0e#HwWd`GLhd-LF9&zVMi{pOV!XY6h9BSJot?}&aY)89?PZ1MV@$Bw)hy&G^ACjBHBwv%erNVu~&Om-9iZIZLBQ&wm}Vh12bc%|jf%b^!Z0ne@LPkyDn9R9uVg(OJD?nBl1xiKQ6vXCg_K zz=vY6Xhh51cQTBya)~rE12z-20+V=5@oo{D%*K^bzAN_5*-L4N&58jdGiB<@^I{_v zW$IAE8!_}`5X3=qD=~sMmOgBQ3yJ8yOzPNWZc4%rB3OQ~m}&$i;oy*cC=vM+lS4E`ZMd6{0 ze9$S%0*23RwfJNizQN9NFovo0KH!hyk5q zjlvDrs-G;p^V*WTSauWgVb!y#e79}+se_$X^63`$9G^io?I1O<17Ad(;@TT`X^5H< zC9PDXiuk7`*nXiPd0uC=c5I=%zPz5}-);`7sEnB6oQ#XlHip5=2@TTu1DF`=ofW(YfSYqC5#s zr{14@_4$w5abB&S_R1)k9Q>P33T+s}a!r`#idk8b{}C^CtI{v*Ohrn`44CEf!ZexY zw1c!sJUg%h(XynUR=WtvF2pIfkem`|VuBi&{eOvxB2`~DcPXX79|_ALZu-`WT&)?o zVv7`B_I7PY;?yk)N3bV;r8jvm1(iMNYU@VReX3pb5n_V@x?TxSWTR08V*72&D%DqK zWT|oTHN^ussj7a&h16pg)qk)(dnk5SM@yNCs@4IxtuXymORgji8k}uwcZ4 z^p3@@a4VtO;DS8^&W~;*xpk`_WIToDtCH>yT_7c4JAU6fFxyrYVfmMc?obdpgO!lKP2D5dwo ziG)PlnL!qK(U|7au1fT2w8=&of*ny7-gCY~W_%9m6Ww0yqXD1^zI{7g%HTXZaTvxa-m-$FqK^8*X@u+caN%R=97iZGGPREmzV1viIc4k9wJ>dQZTR zVzW5@C)Idm_GN1ezIFRGem_P#QlQhONfonF_agZiTk#P;fXzla+%y?F;ie3nT zshvze`|`2&hWa#e-6DEvmJ| zsB|16w^1m1swN*>H?R-ZjrNhyv$On;n5+{33U*(CjF@>k-NM9yyfCA*0~9CFgv;-zIK#_C`3 zgljL_Si9IVoR_&Q?#=3b!e;(LCys-W5kGj)3;_uYH8%4?^oFd*uHY$>2eaaAZMqoa zh5gazR}y@FnvCLghFx3wtZA|gNJK~48wjDb zFhs?NdKjVw!gIcIC>z$FMv}Ihd?w^oe5dZoeV6|EQ+N;Ito-vC<3jsRi?Dr&ts}rl z4*)^o&QVxFkv~(p&+4Dgn?aD|7c5#Zj1k22%t;ivHx+MTeXzPakhHB1nV2+d0?w#_ z3rYOMyAz!4j&Zk!xVo+klAv8_8M`!p&x@b4PBGSLex=uPsEp$zSGeu@H%WVW_RHBN(eQb#4|0PW@FxssROvEKDY^@cX!qU>rx9Oujic^)% zY1p~u##e#u`1jjW5)SYMk+U_hI8H%Bm(IaGd3EgUCMjFym5mx z|DY^OE@-*FS{*EuJs^%`c8tH8X-yL|Z38b{7=+*Xv`tJ^OX7fSb2LMIzfDY~(JC*I zsS7wjH)Cg!Cd!%Vt$(qoF2w0%4ET*DCu$jhJfo$o3LmzPR@bG9f2{@ZJd+9QijNdy zBHNUfrG_#yaM6E_Yc=8WdTcwZ5xlGtayk%0+p5SnqUgSuSgfOB!w_@0?gsbGWd0@4 z3DmQ6nzP?pJW_R!n_d+my4YRaV(Td^#}pl)@=`-2sco%Uy6ezcr@e8f2{>c1utU@H z2}&zO-6jwKiiM0TbsH7YeS*BWlo!c4F|tKYV{S0vJU*nQTr}osgl#Ve7$V6{6;?ZF zt3=Fc-6?Q@rZ~)^z0nC*E;a767=Q%}42(jHCo{)6s}>qDH2_;t1StJi*BjciWdqOh zw5GhBFZ!O2bn!qE;(a-U=<%;^l|+YwM4UH4u1G zoWiL_1_iyb{?R=h#%g_3{@g-XHUbLgN;jq2gCsViUPVLN~qe_N5!c2M>T+Q508*`f3Fe8VBX@Wz2oVd>I-=p8sBoW@`~|9{d^hybJeT z-Ek`1AN_AnvdPF9kZi;4A#OS0&qxDBl6w%xlt|WbpreK)_F2fwb+n!Ne@P;0BZ{RF z%CP^fOi%F(epN((u~KP8aSqJO{bBaiGOPbdWZ!kR8~TficO%Ii-}RckOnix&UIbzP z+03*E#S$qPUazf&phH|Qf=*Es;jSvi-a{&^w5##k?+c_|px-?@sz$7U2uq5^L^7K! z84|noS*{*_s(Og3)i3#I^^nwUKY1rJpm&Yp3hHX|#fUS^VAQfS-LlaF*TwceHm@0 z8c|thPFB3fv@^aIG*3Z<=fBy{K;QHPF;>Q{b+69Ps5?JvU=ZYVvT^R3wUz(|R)s>oj+iixQp6%&93WjZ{gYyCf4PlY_=F!EXqL{VmyFDn8+M3^g7@$;8L@Se!rKR=1$dj^)3!+npjASKfz^6ru6je?UlFx1?<;+(3OGPBI z1x>@oX+a7Pqe4LgT(~A#1+aEZ$ox!apEQf|YfO?|U=tSr4AemFFQpG3PPTUBvAXOt4+t4)FKG6>_Hn;Kp9cY;fuqAbgX@^zR%^;(N z+)uAmhVXYv8kIF#Ef_Y>&y%K?kV;B%P)Ya>x zXMrLoE;>3ahD9TAQ3!*k*R8+>n*aq zcyk)w`PUi~Z$8<3^!^E+c+3}9;>hj~mr$I`I$r8{_)QfM8gMAB_eWpr>a4q7>l)K{b4HQhX^P9Lf&7CUa(B0w=nrJS49c)}U!dbN!ZZ#~c#?U*-xV$q(5N z#;x__O8|#AYNr6kTpJd-RnCAU|56+0%8*V4&ttD<)gH}ij#9aCW)TOyuLSAXYUe4J zkOB+`92FYEl(HO8hZ~^4TRJc#(9f}3j$TfPGr7U6+C1k5oUW=}%D$ddnJx^+js~MD z(S>GDPoAvKBH=C7h`rSj1whmx*H!cGpOCIettnI;9YVrgg!yB~{l}pfjzr7DLL;oD zT*pa)ujm2P^*jLc_&Tb!RKJqG)Y>O&lM~-th>leIw9+C$!-6I%U=-F2G1-;6=tW`a zg;h(%FPPT;@2KmraLnE;5N`GYZp5W>koc>C93(&|SeClbA1hu6rsOc@#!}9~olLF= z&euP!}ttco=4wc-)GMz{!J9r0@o_`HirdU|1U*ZH7Fl!jo9y8JwJ54xl zlH-q}Kx(QAi^(t5=8Ijbt>raQzbg5X!9}DOw)3-a_#~ppq<9~jju0md&ODUF!Gjr> z-LfZ90RYA1I;u^+U+FQO%=GU<%v-_04Ebq29y-9c`C!Z@MG!ErS`&1HJPQ3VHOUoALn2R6a z>X3bKJyg3Z010U zr)VoA)A~8>9w;=hs+tEcaSyqHMY5!E#9b4Hw-Ln_X6||Bk`R zpxbWVz7n!sgv* zK3Y2~s+jwJ(WDn*`DomsA!*_my;eX2*O5YbbF{3=WPcg&${&z>2BCY9jpGIj2HnZd z9W=r$nhv1&@dV=-pTn#2P@F)a3|@(miCeP}7E=X_Z$Q5rpkLo@k`{O|4;Ya2!EQVJ zS8WE%Z$iTZ2EfgNcXa*SP@F}Cq{8on@~;h2RX1qLAxF9u$5Q%1Oy@U##H z16V34aO9{YO^G4Ex9(Rii7n8=`;x!rv|g9mK#l93x!9(REx5qyMO{dcE3>uz$r~`o z4=x-uRZV9!z*v^^j{$y_kCmv^*ZDU(fsUr{JTtvE-@80LZb!y_)F2zD0=YGWh-6Zs zU?;gFyp|HJ@WY4iC98vY70=dg2|xPuN~yQ4@Z*oa&0m}}73q+BY|%=SulP~t2lvf( zqw}Bt%m3}%j0kBKP5CONIqgn57b;cQ1iSa);w=kHMuK7XV(tv zdT6fS!2A)r=BXNxCx8a}T@OtT)I4I>^WOFK)I_Ung+F}zcO3z(@Tng?Qh)vN$3Huh ziMuU;ZS{`rf4$UT`?H&VW8b^SzO@Lp-c!Mr4x+_s8f;aWMX>drs^)b*sur{KxS)s^ zLZQhyX#hiq7D3@t##6N=b7BF8P8z__p+!(sH626SYYhGH(~rL;BLSb5NObi_!q+P&vT_UEksYqtLO>DlfHe0Sp6%eFe86$E> zc|z~H?(oad-U%NQV-#DtmaE&K&$6s@hWH_g`54r}ypr^%w8u z_3;bZav-DIfRmZluv;K+?wOW$R$@(7)hFLY3i6OqNK&=S-pN)3&q?*xddu}cP=Db5 zXxDum^b2#J;CJBu`U>~+HcQdKEZyx~!FWPsf36C9B`E03Oj+?YB7?XiTx&Ij{~!Wv zLJbV^+sQXgm}u2S6#WuaE- zX@=og~q{NcP__)fH#^#My=zw97<3-ZUK zxqV*n{7nxKn6QOaM>!V>c347&unZe~5wG zESg~OuO#BDJ**#+1#-K>31k#B zWfX`x$Z;gYb#B&zFrrE;`vENABT`RP#QrQwtEC)otOMDx-+4O4n!tiF1Nfg)<%E%6 zD7uB2Qi0DtqXPEzxBM$CWwvHE_s#Z*I+~olUG!_UkMN$uFM4m`VruvuuA(On6KdKxloUi0-fB(3c9UptAUgGFX!kTgUnB$1w@@9#=^|5hHP|9 zPWG$Fa*#ki{ExzdgOKoI18kK+ zIpt7Z&K^Zrrt6Rt1s)Z*5QK`$s{dBCv}2?J!2y{|KmJeW8a57^x>0-)!ocu;OI0+w z53Q#M0x5O%&bn&K6My4Wyh~41-+QKcnu0E z`x+qL^B2*5W~eN3lJ{YE??BUVxF+Z&f)~JcmOSt zI8;}2g|lq&%Uoj44-kiwDSVpP{({8(LqebS|9v+M?|xVLNO1^gDs&itv(20lu;@%& zuxO0TK2GBlNqwb8S2kEI9HC%97019(GL_(8-tNi1-umpY`yAVPc3@b-(yn2FTqZjD>gap=lykoGEgH;OM$Jd_&Sg1-dV4Sv0fv80j?b(-V^J@ zqH;K!pta+D8yc6{I^a;kRIDHb3a}hh;Bu&LV9`h`;D0cnhF3z2Airf?!+rl6F$S`A zqxD~P!r*#Pv4r$y*xs=~7rpDpHXG>7SFA;XS^#^s%|GAB>j7vB&D9ijiyr)4g+#_z zvzY;9iX*VvJ!-FNLF>CJsfzxy-=JKeTC$RZ{U%h!7N70Y)37|-{&QzI?y|nB$XYnDzvp;ybF{b67Cr6LSo#6QeZ+lsOpdw>| z*J-+CRAy7n>$@p!R|t*@rd==6sm6k5O;X-LeaJhd~aX+`RQ7@JkH+(NCX@BYcX z&H8=K_#)Vk4cCvvsRG;-yzK*{V!6zT>VN`JJJ9Bl9x$*EJbC}@-Ny|UY=GKUagwIv z{||bsE?MmsAW!GaEPhh@t)>iiv3)Ap0Yi$5$Ju`oX6oEZ{L&_>n48{dt#G=!!qO_D zWZ6iEAQKl^A_6~&*~3X+To~3El%ZuoskV<)wGHcw(5k0^WVW}>j<8>~v!JN3rnwf( z13=1m#35P^NjABKlNk9!)t-sdBx69x;JmUs&iQ5Aa`9Bk6#7C+_uFi0bB4tO%3w}J z``T0bgZHtSBkMR{Y_jik# z?h-FDj#qQZ_1Eb&i<536B3ww0ekP%RzJFe`uu^PYn_~8M*`l{2{#F^KwL=P@Kr_w> zZ%~x`8>7fWs(TZFoCc&;}6Pt01f)G;*Sb?q}<@zG|x!*Z~51 z4A4rB1eo%olb&*9@wv=C)qv=v-@t3NeJzKD>}W+?Stpbza6scbq3~ew$CT8a^6n9G zozb9HvGmR!T%=Kzbcz|N96>5Vw2ES}V06Vd@q^e~b%vbnKgaPW=iDhGR=q@g@6ent zc!V~qCo=H!_osf`m&0hb{by9CS%@tNfnJD?wUbE5=cb-R9u=9u0j4z=@cd!%eN3eOF>kVl+EXVk%qT>>PRyI(ho+_YD8^TFhNHIW=`Mhg z>5y$FTh(BE>ua$F}*DN7f-ssA@W>5qy63<{y7SM~}(IJ2eJ@`m^uOw|? zE=?nhu#y5afd_r< zxLRf0T-imdGy6IbnG@nH5fqF#3`*6 zE1JL|D}b;XcoDPIaeIBNQV{OW!~Fm8IUNeA_Fs>PPJ)Fct^`En2&w5x=3KH3dFm7+ z3KJ+=9FE~`x(+`Zvuo9P+Ip#idMQUNrs)Ot!s2zrv5b<6`x4WQI4MJy?0!0>fMdJs zW5Z}$@!TM*ux7i;-lbksP7dSmVHjhQQ7k$_B6&f{VW!#mHcv!XWT1kspsIa2q{;py ziUGvdIS$<8y{g=Q4f9!%PuVfu`;hzx_HROlV-49M#I34e8agmJu0b zh#nht*}Bkn3MzcD#igZFeAoA`oJ1g<3Psv@h=I-N(fG7D8_`;W1i{HagVQHm6hTDo zB8rf(!3IVUd{vvRuvoC7Q8kM*$|kxJ(79YAWQ|fkZaS-OmBWB2^?@FZI_%46af6t3 z3u(y|cshd4P>*ii*XP8+W;XaAIs!bx3_ux*v=p#L^hBWXrT>KA>Rtv^^<0S~rNg0g zqoD|afD;2ILc)B4q9AW=LHpWKF)B{YE0auG87W@$V7JA(Vr8tn+pI_#JHx)Q>>y=y zp^c+vzQ9E2`91;!0L4I0ZIU^aK~m+frYAc$5j`F@FlNJo=j_EGj7$P(v_04z9nL+C z;U9p%j^wvDk|nTQ+RnCh(Jrs)aJPlfGXE9hW!)1I$=p#Mn>LfMLp#a%#)9(Z&?5d7 z-&^9=7#I!6qOLftW_PJJjJm#b(LPXCM6{Wb;@NDF`(uRgG^J*3OvW!Fd{NZ3SX zzYM?>x=1^%{oUoVa890)bNlmh@&h_L&u)=iq?_PS|&SW$tk2Lbpx8qD>N);c8yQQ@A_T?zLM2BxB_X65s7|iS7?5m;vRk$Bp}mMM2jY)I0GI_ z5?9@#pwDnBaj-Jy<+^ULABTC`czsuto#4=x)HNZey)fw`(lZ*Nya#;i)ZliNNB1+`+p*=~U;&T{(;t z-;9wzHOw;)4>X+dF$1!kYwq*BDoqA)r3}3mU5-Fp)D@1bo?b; zqoPYxvf{-eAtf@?8A$ojwAEBH@7zsCsV&%jB9{_jjX%RTqJa(`%7u0OTM6dOMyM@D z7>&~0(|~YN9nJMb{*mn~@jRRY>W=RgR>3o|cV8$n9*{CVJK;Mn2E~xbpF0=cRH7EdEPWKWmF&a(QP?lE*CK=Cmfp zG@2`q<$$(`i&=y z0A>_~WJyf~awGSyK>AmGT-kx#cV9j`+?zC-FW(sts0? z@5FS1fCxnl)B#kO|4|m^e;<}#JVAG+qg6Se7j#5@e>XjVI-z%~vha^bS(+vMA6K6_ z_u_^h^BO*{v@Jg&J)(ZK?bkEReax@Se!VdcH|SSlzjnr9mwv_TR^-3YP&fl;?zV-Q zpWY%{EbMuEs-rXA=2nC?Hvn8ieok8ji>K381_!>b!GtBnX*M<*@h9e(exuoJw>bL= zbz1VT3+3A+C4{no=?D}$p=s#{K4$p?=wlPfk}w_h3Q4S@AzHtVwqMH;eiu&jEpF|S)3m8!>Om959| zL1<-Z;sgN@5@-B$4{^2*gQ1Hwc+WpEQw>C9E$w3tjdRva&Fdxa(-VIn;1Q^YFBrMV1?`f^Zm4LTmB=yO`z$h z7N^0*b`_g#j{{r5m2*zt+T6NnHCJxdfu=Tk26u8nZ>Z{WLZCH~DTt3@I}cO$#&u%; zY&9a8K31ZR$>VC|hPP9vso*@~QTT0yN4&8*I)<922qUUsC~WJn58sK9VaP7y@Vu#H zSS7cNbBWVOj7FgvZl$7inAzraaiqjx*{Wg*S01c^s;=DS|Bn`bTwEp>Mnb17dmpOA z2#*K|4W|`fC&p0fTvS{p3uZ&v37V5SFB_{{fqxCn_^CF`fhXf+Os0ovwe!)Yyov8 z#{7@mgc^upS$}C~;o~?a!3cwIhri`P(r#71{zb1-UN=k+evl*DnyrJ;I{rNrt=l>Z zZ(-UdSm2|I#>`pgA>o6>8z~=nSh?FBjD<#rnWD(HFtQ~){88h1I@1PD2><8^F%O`S zOPA(DVNfZL_(~2%`LWSqVTqJut_fihonW8fJ6;yKpL;D&?j5*O|Z-+13idz#dt?SFt z!$J!0yH(oisat@7h1Ec4usfrtI&LpB$eI(aM$VnpD+19@b%%L0XMFSZU!!eP?AT<` z+^5Cgnqy0`Wt5!`FOfeLmakRnZc(f)4;5?rNyseBdZTdb^VZ{5u&L1Q(XhtrErMrS zq~LT|YeNpd|Bn%yPa8*;;)q??yb!De2euNcPEv%p>0#j;zsvknuMlC`P#jcb6x|19EFwIF$d>l-AfFPB zqVLb4tBLnL#HTubkWZ2Kr}SF|?x_mgRTVf;6}UscKSfL08U0*?eY~hFgg`DKRPu0U zp%FfK{Kdf3GLva`J~0)hH3z7gd3kS?r9|6x5jSuWCm5*rkNT=%Su z%468ptzws@?a)29O<0M%4MjL}9ZtIPV>nKm!@Y=N)uh+)M!_dpdfVh%%(Y1u9kT zV8%@(cQrg@?w*G4j%m%wD6+dQjd@4nd&pN75=rF51GS#Pi7^&d>+k+lSW>)!NlU|@ z`eN;^M)CNX?aNM3BLgg7hNRZw?v|3=qBS3Zve@yc*jpw{G!ab7`bl_*PXIQy(aC zd+63G()jNBJJ8SQy8u-q*YaJx&Xe}?Dr@DCw}RyCcl%IXg}&zMrfBw_`a8`YsLQC? zJM_caeKQTuiqbPY*`t~^hL`MUN&emq*&-gC#y%-S>4gI=F=*cu;eq7T^& z{NDzndQa8$W+u)|4|yeS@KPnMlBr!lq^W#Jl{5wFd9H5Z0Fd6JA0OZigFB$_zs+|B zcSl`=@3VCUHFdLoP-bRc1Lf8~KnQyh>l2Z01HBokVq_%D5W<{Iz1@4*t?z<^R%i5G zvocR^U()SWqv8h_{$*3Uy~Y#zUe%bd3ki-#^@B1q^IyB4p9dX~gARx+N;t}!%{PHb zt#5K4AeH$hOK|E0%YA_BmoICX62Ht4YtV_*dYD0tX_3Iq0>xhURs_SU5b6#oA zE5R50l@8UF4pHfe!AkR9Y2GVgzw|39w}>HWmP)(pA2UtRhw=q@GjJbf8wr?(4u_+8 zC=W&P<`$m$VLNht1fGOy7QT1L)gD$4OfAgJJQ%^_VZpd_>;V_^BJzZ`BezgIs zkK!_=Q?!5%EFVv$hk~A4v8+LLc;ewCjM!%=EN+LQ zr1KgM;km$fYo?fu_M8cClu&7s^iaGSONGw465Ui@eS}Yc-Un{rNM99@_!zt$^mj8< z!wr9B#gxh%d~tC~L%W0R{8USYK_s~DHrap$7!~hm*%s)zXoz`!XX;Ts?#3&jpoxSa z6^SU0c_z46ozwRvf-C(>BqsGWA^Vo#)Pb88{aPv!1`eJLR-lpwk94u0+_->J9=X}X0{6HZv#~jUQ zr6wI#fNalCM;p0cksks9k201^<>E513Ds7xx2Ii6!u(szBNomzZ+KFCFJ%Ep8#!XB zmv|{%R)Tlw?aJ+iAEvmqK_xA9%;)ff=pv?FJ!oA4xGWF6yPE`4uY`S1JT;5X#%koQ z1+kxDYmopsiTc1zr=d|i*37@3lC#)?KAF8H(+wRlJR?c%?xva^Kid-VjUb6c{)H4$ zE`3ioWxF`c{MqmS6U0$wzGcg^EtZ@|WE8Eh^7Mp6+Gx7JgR8(=Wt>NAv{X7~9kRN< zJF?GCm|v)EhjL`QG1^0Nr$;*}wW~W)<}=+<#qaQ~998^|XV1|fUQ4i)I$adWlPZ!Y zJ2DvPn53B20R0perr3*;ks6vDXi#x4B%v0*Y4l9!GV?ee-vWb7wK=#ja>)8?g;K7? zp?JPg^nCNK?s-HeE3=p?1|;02pREd5^XCi@fbQ8~m6zG(9-g4L z;!hJ!vdJNUU9Q)S&Ftht_|O3^=O4V=H|pk|7oK^mT_g8{w9Www`DOJUKsq_7A_n$g zY#)F~rZAA|btp+%X-j{yIF86s*h=8+DCOe(#SBc=NTrvQ>@qoN{W60Gi}$pQEN})$ zG$?VUSc#bY*}Zf@R((Et87tr3S*E$T_+pGrM|FC#(O{#!hZx0+5abb&+ZIjFk#_?_ zqE#uDI58m)51h*X+L~o$vbn}?>N>waNx$GQ_}*eZm6}V1O@eoG@M7CSqgYsI4p^U> z27lc~ii*Y9WmVc}g6;WlGslWkh5okRFSVX!A)u~Z@1X;1)^{ zKWQuD9ww$)2v*B1*Mi)cifWdOx(LcikW*aoCVws?B6%c$D{4LrZMGp!7jI+8gjq`% zw=H7bj-wSfwZKzEyJyr#U4)pe3du(AH~L0%7ENf+gKcj<^js3bgZQh}5xslX zgd4wX;gsR?)uT`LAARHtQTQv8$o@g^5rW}Vm<}7q%IK^kJx$h?mR@7w(j!KbrT5k` z_p7hA$ZRRy;^G$md|Ew2P&uLJ$ciN!wsaMrnuLFPltMaD^8Kb`=QK2?s(i8vHMSj| z%iY~^5*aaLfzu>vOP8rUt)v75UJgsk(mp3aK@q%935;MTWM+vJ6toOgYj8i2?<_s} ziC4o|`<=xc#(c^Y%3=I-Qlf_0!Id{NC;|edSUKi@m2LM?2-wS@#9Tm#3Ru@Ch#wAL zjM$C0c+OO_q>8#ofm5NHUQ79xgpd7wZ`{h=5tW5*HY0pJm&Gs~zF}~T^6i0WohSp< zn< z4t%(pIBRK9Ps^lk>U${BtftWv2m!ogMc!fhau_uW<1~+MW$MG~^%Ai(p!ud1C7H`Z ziFYyAi?Q(4FK6ySTOL13p9Gc=Y^uItkEfMXj43$MSt^Fw=7f!WsdH57wl^A_+5}Wd869{p zB_H6h78NYLmEm!Wnih#}ndYF_*5X?k8U^8}VjInEdd{7XnrWV)nrSZaJpoF>S)HGUG7;;tibGLlrn`T}QiO#e(FAB?TZQ743!!mvh%gJu! zVUPf97}g9iUBYS#x>631tYAiUCqH2z8 z`GQp~UtI1Bmak+AIw3tu6(D-B_+HcYKuBRm!zc<+MMy%|37uJ(e(f}ql3ci=JHlxj z(^qhV7_%QmbSg-36#9fNH&5%N(Kz@|t8gvFUg(5Q?x48RSBr0wfH^4Q1~xLGRs4_8 zcyQgs(LcmFox|Hha`o#N%-XT2K|9&Fq>;KPmY{KoQZd<5jE|#%8b738Oz1sd6qsle z@MLNXSWCqSUw8hkWY+U18%cJ38#f17n@GM#x=O=(m_1v{tYLVb3?g9AHRCe;r{b05 z#L!p=tPQ#ikLzM~VoMpIzgD{6=04M8)Bw!i%dCV%8Xo!~;Q?gD#lVJai)lu!b+ZH1&k*nKfYUJ;|uH+|070-ci;F z-@s0@a_FKgKoS^N$n4=yD9@P9^GWU7Ln6b_#hJ)0Ay>CJaC{PzT&w5Y&B|}VwTS2i zvG~5Ik5~=8W4WSvv%(nU5X<*m*2WNb)Uf2vBGQw6tZ*(T1u0@PUg26yi5VX{e8y`; z0hoU^EE`b$8AoHGuSGL1`y08<&Z@fupvIo@O7fd{yYTC}xn(GVH2Rl4D+?OKxx1U( zK1(Jg(am!`eQd^rocac4%`BrWd^zr>-@*#ID{p0-<_Nq}56h1IYBCvgwgv*%~ z;HbcZJy1wDZy755fC#=Qc39za`3{C)XoQJWQIb2>gUKXZD{&qhO)J5BqSd5eMP+es zncg&*6WPkmkaNCr0#}!rRZGI6r4)g+&ljPuzzFmG`$GvZ=(PA8k*KMk=CoQB3lwXr zTNx|itKu#gS6?IrzZMJ5$yZz8IYR_+sSgbw(87PAjh0Zrl6agDo8eZw9k-KqyPd+) zhJwOwa06wye;QoEAj_Le7Pzla##6=z^1ICkifh3K#()__$Ox2rmk8YX7lkjJ$JDz^ z1pM0s>MWx>uOvTS+Vf)cMpPKwNT=H&DuH^$domC~;y25{=XG+|Dh^MwW ze3d_DZ_s~}OCNe%lkBoj1>!0D#UB4D1tfd%*W|KISQ&i1J+;+~p2Sn03{wjnUCW%(UKZ}E z_Gp+49&hHEHKZ*afAku>ejR&x1!@T!`=eTU{I3-VTdDuD5>eQlop1z5AwHOdKXnPd z2OYrQL-42`k+>(nXmo(qcsD*hHi8p|KlouXzR6Jq709VKq!t@cf<1gXzNl<;vkna3 z+=9SyF=3~amZuY0(KtO~mv5T_5Om+A|4#k4GW`9z}K_8V%zPa2{vEsqNOVoA4GpzMt{F24tL>QxM?)p@DJ{T_=iWhmWoHe z*?+YA!(M7{?@fVB9 z37KKYzHq`4yus>*ub|AqV`4+`nTN0754Q|J)mAe*8>yUDsdOqu#|YjKx(| zSxLGzFwVCmu_eb8fyZIlnuJh{IGnd8xl^AnS(6Zs5r?&Fk`L)~P9h2VEY_fM(bj~n z^4TqdO~U*kMH@bw?}T2Tj`|iDAw{_FEGh1d!=CTPVXSzzqVuAuJ?R@S-9PnD$<(*0 zJeBUebOj%eM?Ac4d;XterR(IC{{6l2>!y-7qq9zZdyG+`>QJmprmA>q?VG1=-LZ2! z|LoBF`$znM7HxN<>v+KXL)&@3C*84q>d(IW-0Si;6DQukUR!5MCc_I9i^;e1Cz6|o zq$4nt`?xSU3>CkTv8s53vw=Kr2Zwp}Vh~V$?$+noYm!5F`olSEl1Ho0ImMrXAs@bG zXg9JP>>YZX6Boh|w=h2aZSWHkCjLEfwHf0V)<}0#r~d(BN#mpwD}Js0S%h5yN3c9`YhHe_vtaaKPsr@CPfv`E?lJb1-Qd zaKJ@oUCe3f@$W-$(;oQMkSIPlqq zZPE|7C@CV{XPkv$eQPIIE`l^PHn=|acyy(#4mOh9$Vv1vRd`7QjrmH1*{wS^>qv}D zAV~=NW7T5CxNQ;6mU{!U73gKY_JAT&d_oiiKxLDr{9q(XzBD?FA_^y7L_g@TjIDSO%XBz`5dy72>c1o{nNy0 z(H60{7=|=4VRuOWNQPfckL*JNbtyiizzBSLo3S0Gx{%kH@eey{5D{q@qCuP>W&xH% za=SP{nq1(@^KTEO@%GB7IjG}xeQCJFA!J$45nC#O*M%Uquvq(oFhvGp)tjP0dJgv) zeeXRng|0mupd&0+rAS`U}=b6h{??B}JB01<}By>JJ% zRe~paQ}GKdEs1E+_Y4o!=C%4+x4E4k18tIVV6e@ryiF7;T7CL0YE^Ndw91+!PDxwj zq|qo9^8?knlUmK2HE8g3+p7Dex5VKf^_yYO7orPS(2k-$)sBILjVUlRDl-6C-*dD$ z9X`uXno(IPiQ*GpLnEwe9MD&K{FHsx1H*#w{tfo;80-hCJ`Hx-7wmV=Mdujw3C&Bj z3|<(^UAJLK8j`D#YjW*UR?x~QJkh%H&N7*LqILcD{12Ccn)FQoA_4 zdxAadxx#S-5x7>KfF2{UR$s}c+*UllWCaejgs#j~fLbt%EkzO3Z%5i-<(jCch$wgF zYKJ`SsxuKPn{1L9IV#zEICKTo)7mrfMw`-VxgfH|6eQ$u$!M-k1kS`JNQeC7oUWPz zBAsdC-*qCpe)XgxRR1)anhv$M9mNq)z@KdGV{T(>OGMCGAS}~lxLZli}>cMyX2kRPq|q%QF-MT~RFNyP!70`SALVB_aOtUMo_!fRSfUz_or$ z?j8d|s5V7G&RAb4 zq1t6olfA-O__6R+>9&~b6UmPOitUh9QjqMVidI63w_^>jG?9D(RWUh5q$ql?M0O1} zMOC~Ui-0sBh(BbYwN7i@Rb%kzVS|lrLSQo0c63-{P&Y!CFESAi{Z+JE)gZS^U4vI_ zBSJ0~gl8jCjt-=OsohlUjR0SL63Xdtg|?=%@Fc>92ah9hO027V=vgueN z>^>Hx4H9mMu?;3ctAizh3C7?dOg?U|Ct<$Jl{_FR!k0TJ(y=X!AP~f0z8Ekdz(E2m zP%b8z4B$48!2~CW#DD<<%`+ZiKrklZY2V+!YVCc_>26^&GZyqYXYci>RjXE2t*TnJ zz@oBcX$utD%PAorp@r~I?@5c-H7(N0!zGQL!Y8gxi~o@Wc&4aZu}VbU4D1ck0vVA2 z!fjSe6*EKH#Fna%0tAGawt2U-72=2adzJ!;Z;UR+F*7YO0J~bqIh8T2x;i={=Ei!O z(5z`X?~F`_uXk9S*ON4 z6^$6g6`O~P%>u9(wHO+hG>$Jzu4%@ih(M+;_C46!W?Z2$>F5i*9TvZj9BDHvHq-4# zr!BKB+5z9CIE~z6mb1`F(>9pKhL*7&OIqnu!z4Gu>}D)|;jGQwjCY%(B4G0UMf^Rs=6(Uj*7OM>$-<5`GxY)cbaSMCVfOvMd{r#5xT}*co zN=E#kTkzy>3UNh-D*3#YxTYbh3DqtwZ|aa35 zFxDy3H3^RkfA=t+yh=Cq9ejJ$3HHz8>&R-Aw6~ozg!oC~oGDR$mAgeFq7Ip~eNs4a^bS}!)5Gd#MN6PU!{1CrF==alj={K{YeGWSukE#O+#3?7?Di1Is ztssMHot00Ym(Th)&ic?)=LvlR9N z53V}P+^fWFxvc7VK?1u>RxADy*&~Y^ERUWX9j4Seq5#LgbVr&IRnmfXIP_Ay2|o+S z;lp_*-Aj@a@E~HWTk>8Bsvhap^6;tK-q>Nbi!rz)K;&x~AwiZbVz962Q+x1NPx$8` zNN-B;gck}P{z_8(rU)Q%?Ya*0P?d&2lHxScQ}OPU51WrFtHR4a4^j%hD}a!h!z>)> z>2p9q1Gq*S{_XtY&y`@%!b^0bv+hw7e$~F>ac&n#U^fD5ljV)25K5S`nyfV#wA~=y zMZT!Kdlkv9d~*(~#15Hn${|} z#}FhyZcHtmq}WVz`dVxvt42=fCAiOBW zfm5qLWl#Cry{egY>RCvgXPi&u0p}w#h9nA1!|b+D79>y@Ji!s2>Iu^cinBnlg3TY+ zUR8SH#d-x7NO4YQRzy0~=s!OpnTIbE-ja7x#k%C-Y;i^6RLO4C%(5nmBk|xohP+r_ z2FhJYp>PDtHq!Pc?YJbq>Z)oRi#u%6WD~H!%}iM?^9At)-n4+L4a+5*ri}>$^oAC# z+sVp29#cF*nD1I(v7?b(N!BwrNn1vIwgD(h+NDqrtuSw(SF7=-6NsThnz*cV5;KQ0 zemuEY3wWqeXqq-UG=RGL6+jdE_%4z+Y?%Zg&(uftW#rH3# zlLW5GbrSR4h5f|e6q<78uh?QPQ;HT_I99`WWw(R7z=r9)BjhIGC`T;B48$?QM}FZy z&`rUX;~pyda-EkW3IFKjc?X?KCR$JdKQ@R66jz`(1egxqSTMdv9Hh1e%1-wZ76Am8 zg;ZO)Oe-lZz93dru|1^Kx!HB{Ceapd6Jrq;I}Myd)P33}XEu_@tVJ`ir``hRmHa;ZN)3G)%*@zQVj*xT} z<~f_)PJ3c*EW60J>lgO9+=rfp-37q8btW{CxsJC z7W;q37XZ0nGk^X;nVJ|5$_NG7b3uR*s6rW7#V|?E0cGK9KUEb9^hJ~nPnX+L3oUO! z?P>8lf7L#!OwUd)M=`o;LhQ4q9<{VbpQJxG5z|#e@)xq@(jhEXpF(jA<{t6?iL5YuBEMuuAA(s$*cbuK)X^b|NcQ}p%al!+n}i9Z zIhDd$uzc7Mzh$6i`SVbtb$Tv~pXN>uJTb>9G)o05A^C%W9%=D=*0gA5hLG`Sc*}yB zOKHt0#m-Or#F0W%`(73W|78TIg3az4I*uqnp#nLqmhOK`D`fyny|iowR9w(&`(nG= zJ~*ao1TI>|#L-rmr96@7ZrLU(WW^<{M?jXRd0X*l%g`pOGvyAl(5qrbgrzc41{6V5 z{ba9gW^PupJMa_@#l6bTItuT}gNy5pLi7mo&WZ zZi{-G2mZ`^?Al(ICThLPh;__ zvNe!}A4%G0X#y?q@+M4--v(wa(SWuYb|HT3F_z>#@@FXt)y955Kqj_n*NtF_&KCv(a z-tPuPNLy?l3Nc?QbfS|DGC_2^^h3kp=C`E9yPMr7SxC>w#`GEX{y0G#XS<9DuOKGo z(ZMton8Gs@G<4zz7Dv+kGgh02a7!^u!}t@DRXz=(NES?)p=~KL&v*(a4*_va52e`# z^9&uF6F{1Ex%D!&kZ3iiwNmCr6 zshuKYZDZ)v5=61&UsBwHCtUMy_9by~Tl1MgQ%c6M!&SEn85?X?Wso#z0T!+u+5gb< zX0zL5jnf`n#~QSt?2O$QP~gC!M;=3G0F)!f7BH)IkJpu%u>=NXleM_7`;&+G z(Qr861oJ&1od-(**=u#IS_>!SPw91c5r6^pF%x+;6S=Q0|I5(Dwr$lgQj?T~P#fKj z>&281kZV&7l>arAf3J}s&&D?4@CK6+V}2DZ9Ju z^m&uhr&dr}vN1NOh%QlrfnR*MxEh{dXMapLgDuFlxmQ{~1&cRjI;A*yA?Qt>UL9!X z`Fol?2S6z+TLv!~_g0xy=%u)xA=DAZ6y@E9YP>s)C0Qo0T*g&{s(54GqZ{e}6}~{g z2SGpw1tm{Xk}arDzj`#=X?G{l>TaH}=qv1qi?56w>XMU>_Ocv(hhI?@iw%hEPhhHD zkn4~}y24zAKwXDt2yAj?>Hzn>%&>1!=#0WM&J_j;uQ(%oI{^ihTTr6s(cU4GCO*71TCq@$Q4okaDE413zg^ao zqMGZOL+3@6dknKPLiveNJ`E7NzPtg{mXQ{4{G6nPYT?hAB-@O;)Yb&<(p08A|Hqmi z@3HC|9K@sL91oh7opT8hN@UsjGUh;;iaAV*Iq2GkCCs6fFsG9h`HR)9ME;#7L^*}i zF|r3x#O*xlTMmb- z)I_GjPqf6*CvX8?sJV&>E9~Wan$=5Ttz1RN3?GIfAvtag1=`^aPdDf(pF6Ziv-h#$a!Ps++0`^!BIC`fg>+jk@e>Ud9^qs6jqGcox z{wF#FS|qH;=Nneh9Q>I)m@bcu9y^=uViu^&5KEZ_Cg!P{6O+9rsCwMX(&%y9iYP4A zaWV;7zCaYKHlkNn(w2QClRGMHC8`m)OulGQd5S}({rsen+mx~yK=4xztw>`l$*3TL zf=MCqu)2}R8SXF2cKPX@9BCf1swYEPG*%F4*5zhf+__}F?+oF$L+p-G_jP5L@jv!6 zCVRPsed%goW#`Z%kPbiN2%AtwV7FOfO`)_K2)Nd&-gIAk4+;MM**4ubbhE7X8aL4W`4`Rzi;S5?l*^Uh$I@`+V~eZY&8pY`aMIWDc!TQE&oKor75C_{I6sSX zEdwjxtnspV7AZHq;C1JOhX=lz^{S(d>akxC9pL*|e;AJ4pQ6`3q5^TTpOFL9euhVc z#dx&AkAEm5ZEBs=XF$*`B&oDpwM|s2DmK`7*dzQ__{1kD5V#@6&XDM5glO8zp!u;6 z6REI%B_Vkoev4mn5iOXDh<#!fw0ml^z)?BaOS}`etZ5(UNzv~d2}`CDn((6_(S3jX zO6m^{y9kRs`7J#OpLtlArEy16v4Vxq#PskO&jVOkQ8<1L=E&j^;lu)F@B#YG4k1nu z#g`waEkLVW>UnVqg23fa1l48&kW$*jD{F4|3Lb13xPnkf3;eG~Y+9ph%|VtmaS`IB z$ibIo9)%$MFEH2q<|LDl5$C#5JbPwPtyHb~r1+Y(YDG%2MB=)L^Z%j0#|Rm`00aL;O8rGLoAn4gKpgvRV2{TKG~DHUwHR_|7*X3&$yd^*4MD z>M`>FW?BVnsG#m0%N1_X43F0B6*>S8#kbbddS3iTD8k5Tgp!sGmbAfwXkuG1F z!>6zM!tW!(r{YRC2PuytsC~$Y;FiJK=@Cs$75@H&$GmvC^)M*TLK!)d6*h*yAhTbp zI2CC1X4)2Y%5*)-N|r7&TpvL0(Jrd7)bPHvd>US<1!NVJQ5%EUj~iJNS82A1A#%%g z9u5F3{AzWc^l*v^GfiyB;p$AM;ra1|q``-7a8bEu;9{1k&`wX40IqWt+8IGCepHEI zLnYc~@ylPudFrZl-s48Lot-KouW_wOEb+s9eC%Qnn;c~vYMq>R=Mrr}d$Rqp$5P0B zI{!m0r^lbCm{)2mPS^tZ)TP83k7Phgj45SCLGs|j7hN7G%7>|v+eiGyv0hq+@T!1% zQ71gzL?6%#k#@j&uk~mFt+4C~iymWRsExRNKdvUFs44U0-7U#z}s5%g|?7%?@ovA@hN**c(_u9WMQMl9BA62_ir-QQ^m2Sa>F6Obeb*? z{rhsV0pr!;1*hHpqal*z!N%lrD<{1tQ_ite^z~$VFp7vRWjoFJk4!a>p6SpjHLN}0 zmIi6(`m8)|D9SS$?|I5JRUK`h$@LOrS`)M3>U|>Nj8OXR93~=@%4af0ioyF3E~F+} z5Y1v1M)&Gd9-}hfbg~`iJEreuIFn=i?mSfvl5A7148>^S$%oMV~_j^*PFIP)@04QmbO~WWpZFj zgMg((@mzCt;h&eW5>T#}RT-nGQqZ)vYyLom%pSO*?69~-R@^EJ9=awl>cUgCY{eJ` zo+v4y_@FFZryk1(VE%UV9YmM9o0XfOP$v90v`9@8QuaQ;%57%vuv@)YWtK1)A_D%P zBhgvt|8=gYty5&`KiNM3VC&dR{J&It5_U7W{l~3!_Ft>r85@H!K=TBPlN?uxUS?R$ z=8}?!R+A%dH=XJniilR1^a$(Xl>CCZ$aLCOCVr*E?RBiN%W>5Ti`*nS+9s}JGN`hL zNR_pjmMG4K;tKiTn48wlE4ZVC&G^L5U08~^c%bTgxWl3FYUzSpT~>8F3_e|r)ztxA zT@+u>mxIop25jLv(8YI*=_2LS;qwY@ba*N3453BWr7 zqoaY)OiPv{qpzC0oU^#+`&d&tFJ0!0@BNkYj#QP087_E6eUz&=^s7!=r|)=nD_1mLaF zw{qsN7tE4vNx8*oFA=)sTOjr(*ecgOh#y|S*x|@Rig2y4iiSEoaop1j_^7}+? z{B3iFDltP6UJrS|_+SqH6Jf20l!FIlrIBfC>WbcY*;EP>Hr_aKHMlX|FQ*%LNUj7Q z5I?tFxg6Fo72c;i#Vg3gEx#G0&lBBPS$wcbFp{_k?^r9v-I&0G!Zc2rGg;qaL}V-hqiEsKEo ze2W`hTS|#Uh$%sPRThb}^4Z>$N&OfgdT`$*3@1ed_KGFX-CO)U9Sk848hD^o$;Cc= zOv|i|(yY9wK#l_`DW0wX8q|mN87AA|rYtd>imm5f)MAml6nwk{@tvxlLQfVpz+wn_ zF0N!5$<$mNW+8f7>m65f*a-i-C5S{JP~yKSqI+Spuo{AVtH?~O78F}QBkNb18+8Co zBOtSjj}nC7EelODUMTj>&Ur|YXcf;>tg#lQh|2z1&g=#$ia zf|?t7j}|XYYjWtVwn>}2gp(TnRY~2%-x$SI@p1Hqrbd;ACvGX7R^~2|F})Ff*YOJ< z)6DTiAQf*Jv~4Y`IWf*tXzh=db^A=naK&zwLp>K|+wqGyVelJa5@D+cJ@0ae5;U7h zu|=r18mAUVrT4h@q*;NBOsEB8pAZdZq9~^MQAnPfq>g~A6@|lgUx?j0nVGnwYLH7=09~;|O2B?MfF@XUqx)@L zG|nnUIN2!$DXaaocofATewe#72#q1Q3c?m z7#xlGMnU36u(EOSSP4xh308ROo!LQeat$z(v)QFQgM}d*ypPOK^W+(^S6*+Dw#D}_ zE!t$j%rOsWzW6yzVC8OA@p?`eP?j6ACLMl8Mh{H}WOqy2FU1Pj&WBNFVU3Wg^>Qe^ zT*}&UyDME1LBRyDcD1K3*z7SD2lE=){nsJ}gy0A~=mZ`n0M~Qci<9^*@Jn4_yxa0r zfdDFBFS#1-L8CkYUc!E^+c}{?f=oNewC_s;N**nIc{_^#hWG7>i7Gw&o>7U4wyuqwRjgc&yfD)Vboi12PB zV?iUr7}029725MyDo9V*R@x8ZLP#}7b~uiJsC25-#_ZxyHQ>UKoQ|EN2a1+;4I7hH zcGmI*$FCnsUuM5w^7Xm)5j>cEt;!oSEDn zmi6Hei`DUF!{-Gi7Qi~uYHXC6v|7MP*l&D7@)MTT=#i|r;85+%P6GxG4FR~XW@ECt zcPao%hLiahbP{xj;;#OACRtY&(f~l{;ocfG=BeqqGJNXjzoP>VUWiSt;ZJXM**J_( zwM*WG-V{vsBTY)%9o&drS=mYOz`7)IHIA)qpL4|b!LEq{I8MjK6ODIMT7zVy;(z7p z?d8;qjuuam98pk@>F;n4{%dlSZ022VFsB>4@Vuw@qLLjMe%Z- z|Cm&?woM)DM_%2ecM6~r6Z0F&ZoJx>zAqN!r2j_$!w z+0ikB^8^tb4KG77eZbT=?Y*$0mZyw9#MK|C4aEWF-+EC3uvDkDRtYTjxh!<4I}QSK zG*Zh*7>ysQQFprOXX~Vb;^8lt==Y>^%fRRA2yK!Epa9lkyx$74 zh@jL204SzHRFGw$1lDjMg)Iq~b%KQn=NWM=a^^>h9(t<-PP``+rc*x!wd8d4RtE!T zC*hBzpeyGi7d@$RQysR3Do1eG3=b+hEwM_hx0fp#FhcnB$qBDOKEmn?+whtLb?C>s zGo+4?gS}Y(kHsY^b2oPPO4V-m3b|a^IFpU$#MctGErg9=8Dt8e&(^- zYp|QKvp-qraS}%@1BOZF9O22xMfOvaCC+(!5`uY(>5?G4y9bf$Elus0ZNSf zNBZOd#P{_H`}&4H2@v}ZpVI#so`TaDhhi49f@o#i55(p;RRafQ$vx4k#Tr1Vfs3%9 zfs7+HF~z2SQh0qm(flywU5b@a)M6q+&Hd<0+Py!^^1W4*FZ=08btbN99_&c7NQ+1I z(qf+d+a~3D>ma?7KXAF*o=^YG2}DRPQ>s8aS@Ab)OSF=Vq&i2D2~464flLqjz0UHP z0)br;*N3{{9PVx=qj;wl22Dv(rV`8MkCrEXm;T2qSTUMc@mHcZ?csO`0kZk4WKJA2 z8?@@>+cGUe%?%x^&uw(7EkD&QL}r#v59%MQdHzbg2pv*WS}O~C%jVyHILgGB@G%NB zijgJq*|rx2gfIsXw$`1i*NMQ@2k$j!zARha)v3}h^6aB1*m~9dyF6?Ab#bMucMXv? zMrVC=49jpoW|;iGPZ5raS68#oQghA9nZ`hxQLGD%2(KAmZ9F@ab2H&6={+eyH*olr zSL14su23ku*f4}vDJ(pZR%VY6b3M^(*)8Y<8GC`Px^aacWTt2Jp-&UISU1!zu4xf3 zO`>|k1cA~*I3!R!6kJ&PVjz%SUwoq3n{>FY?nO?nt+RjC4Phx@w2ITEfmj`st$X9Z z)xsnm>2-QV8M=XKqpTa#j$L=K!D_1oRTuv;b}_&ZxZwT-KL9+TJ8h*L;z(f7SjNws zQSTGRaJz^JZHrj08g_x33|yU3^J%(kkO52n14ZC-QVLau|6|!pbDSuNgLHM>+_7W)YOg+zyXYE*pGTB#+h!a4he?ubzHim?VrSqTKZN-dl)CS3!#6pBGvrZD1_2U)O=Yr|FNq13i-Xv2czacY|Z1^#q$W8G zAh^P(CXACp{B;cieL*4rA5C?jN<10d>vI|d8z1X*#UU9$q5xO==V|aD1wiGB@7eGf zu>vU`Wz>KL7W0i|BS68#PzRh;vB+3jB$KlmCU5i7hFNMXF=|GgMTm{4(;5BxYsn;F zi-K>b0tCGbHjRtsBTYnDI~tR^gJfxKdS~IW7$32X+a}Cj4Ft)BCU;mP(6h4o>B_T?~){wwewVypnAOP-KQEj#F z(lK3>SB5Y&U8!_=?n;o1Xm?+h@^+X`Ym1BfPn=w}6}3w!Dsp8J7y+(Gt|C3*!AVr@ z$U*X}f$ILA5N$?VLh`fiTry%%E4)O6$p+>;FvVPmRDh<|vcto66JpQ8Ou9cz@oFL3 zP(&z@Znt%zRv{~-sbY(T3ANcYCwhYDKL;hyTO*WA%PilCrbxMS>~2)kcGh34X=SS+ zix@4quynp)i7lj{|BOQ_(@uD+|ty}B-@1YpNZ$N!g5``avBOV1Vp$=SJ$9v&Ef?8 z#r@>dC$rs=OoYSzmI3Cg;xR)I7t84so*ZmgO{}x%+M{`y6xpmWiWmTFc6v!hk(SHH zA(hPz)FHH#iF7@sIEY9*H%K5I!>gEM|0iZSK`yV*NCO>1XJf7l79ymKT(JTc*eq`9#|Em> z+Qc&og%J%^(1Wwn(lR+wg3WSrYIhTc$;pbFbeM46_APMQc zhtp5$7ScuM4rC&uX+*4`=PO%CUn`*3dM8l`{0u&Frs?q(R3L?3VGGq0U6^4{P&bD- zNviKA-u!Cl?yHu91*?|chZD*eOuk9v%>zHnjn#_I5v#i@7~Y&Nwb-#iM~rF9WoNma zE@U3{E-mH?8ne|ejaLOLHnh-2c4RTCBL`2)gyXwI!NKAIRh&52iE1&weR}Hu9Epvo zR+{I@xQ;qdRH<#`A?KU4hWNyoZCV^^@J^NO{Zt0?q>{YTrthLQN`YezI1Mj(rR+oO z{jwEYHjZKzKp&N^bXqCT87V(V3K4XvO&Oy82jTgpYR>~ zg`?sN7A%)L4QNMLf0dB}hDs?+6yLV{q0J{J8sJMu*tcz;U%-w)RKIU&=uncr#t}JN zY#)Xq3H^)9!W5(}h9bmmwk4j8ZWnJ&BR+#g9SFC|8uh#$!tSW%6&l^H(L(`7ujgjZ z!(*gdg7~dH2dhKcqO-)}n?gy|O37?3#R`w0US@vf6uPYES{p@C%bf98O}jLo}&B7_yfrRs8bc~iwb18Msz9oG4eESL@ozmzE z5G_y3nEi126T4FAyqed7@HW=)VbsaWxz29g<2SHn0qcU|Zp-%S3y^}kgQORgA4>uO zp7M}vaoJPspGjE`mERvIB@#Hj0YS0<&^MTpo#&XIkuHc7DfxhpPV<4;QbrWcHKR%v ze}{El@`VG3k}tMfAJ=A=;Y9hO#nLFgmBsxJ%cIOm?!ZZUaiPelD*IV*fG+A`S zA?>n&r7e{?ZJE;0@_?du5SdFBdk^txYEtq|nT(zdEfD<+;+WW9h=kzML~Jl5N*>!b zwL0^FUf4PR@-Osj5tAzh#kavG|c1y1vH%g1Q z{t5d6{qhX1+DNHx8+{mo(H^=3M82)|yLgThM_pR1bat3|WRbo%WtNrp6MRij#zae2 zydGuI`mcF9Qjyiv4T9*!m?}#!t(j0Lwe*4RX+|&Mmyfo3i+jUNac86Z*O{kYaSwpw zOY3KXb>zRYO~#v*)$RT^86Q%egyoK2F(NHAi!%Vk*)s$_dolM0C&h1hbQwjQ4{(EZ z>hEFf^Y-4@gBf@fbV4vG>;Lr*|F1Jb2}tl#zcAH8&ZP#jU^t(w&8(tBa$PGN zP3>7%3lZ#QoOpO^Ll=z=ZeBq164ENJ;3TrRH~OSdC`_R@Va1}f3BEhi`j)H94Sztk zYR|lo&3_Mjws)raw^4W8TDVHqc`v`}YIC>PTRDzC_~EE8RgRYG*ahTV^oR^9zAAZ|+)1mfnvnmd^Z;%LqN)1}HMHg+4D zWta5@0=2Ey+=MNNyRmkU_-;+oN`6% zqB8tqHZmsRZ4hatg-zQss5088vCA@JhkF&4+EKIzLsb6v1kVB}BF#^eMHb*`d@?uyF|Py=&S|rP98~Yz4e9 zdbA>LmEMB>$6!Q%)LRm|L?hK`Cu9?)i!p1a%91xxF<<#RX3yPu`J(}SMN*7@%D|dR%%5<=C|MUMhJH@%xVhab7_JJfw;I2|w2mg+ zF${;Kqi^Os6m2OI*< z9lF^)VGrVlc}Wm4|W$7T|7~| z&>!DnkFPcFCU2fb-X6VEjymtzijkqt^V9L-#^D!)wW!$}tNNG4+9UxmJa{KcmB-zd zqVCyjE*80Iq=@qEDchc`Y82Y4OWw6wm0k-)qk?%bDCyL(4`El@h0hY~h|@ueN3d~J zb0b~IEfSdwQ?}vbCTg9glVWB#`Uikmp=vdO43aOtnv6-S+HB(+}c&5f2C}kxCsK~Q3 zO&M)?-n5v(h-P-U3Hf{B){DqE}1sEN8DKo_(N(&I6iI8#|Z;Uf>6x9O+4e^=; zW0i`T*L=oLOO>R{%MBH&9p#fHm|SGJcHcPz%jlB_oXO67F4{aWW>+f13S%H(UO7y9 zbRsLB>iAlb`-jHG!N-j}6n{o-JkwjWvs zOq!1AkqReJLWS>=QHEXS3Q3Xu*?4?&s7o}6Ec8{K}#?X z3$1OL&LRQmlIb+Wp@%>m6G&v$T`x-vlMG#2`XpIZXaH`m^ikqmDy$rmm@8#SFhXFy zJ%g8px5=>Ob)K}OPT63>1KznT^!M$gGVw-nd2LqsXw|H;zq_EvH0)Jl~>)cf)9tvS89s*&a@V{RBpHrB^|O9|(cH3mxW2_TO}xT(496$e zvLOKkZcJ_@f1;GY8(OR|K998MV;_OBs7bpfPlGXl`nxj5&Anf;^4_NOLr^0pI5SRa zo@R2DR=F<2pGLi@xG?Jk8PuSS4#>9bXWaj zEFS~iSxPW){cJ2WEf-{#XBdeZ;iHxy*#ICGk^w~e5vuOQl~cS~9OvWYg7R~PMqHyW zHwa&9NG9m8iju!Z%c`7(_4YR@9%G@bOQ^nWX;U+plk!RWNFY=nM@rD|Nr3)@Drmd^ zE87Fb?c!Kdyj**LQFLR)1j)=NYmZP&7XDUBfttIJ%F64tBDR!@GYh|Ie|>xp9U7&w zQz})@n#wf2VjKS-RH*51LssnLocz>%3eiBZH)f>q)fecCgLNFI1FDa=%2kkYX95cf zDgysEicLATLCF&sTgIKCp*GkO=4qd=l~mW!02a0bM0hJuJBJFL7qJ}L3hve;KL=er zrs6@)FOUJWw?~H;Gh=AGL73!?xVvjvbReD9J3xTY8Y>O1<{dORb77CF+}^bg;@S_* zUn_GRrdP8O;H4|BX(-?!PH~6YS@^CRVdQ|EDyX3N&&oAI<>Q$x^W(&>8*dja>ACnj z9L?~>&jn64)@*iHY`LPdjIb_%+6E20bdFS5$Hu(|cs=vYO8W#C4vQBcrj ze;-%MP^YnTEn~tivwBy!TFhR4EKVAGJMhG0D=mQ!z72?gAsH?iPXanMEE2=XXqSb* zH#CRSIVX=MZy;E*T49xTP?;)QZZ$n$^NHaGZp#Kayf`gU@34%c1Fez4;tr2DNCr|+ z=3%gMt$Zm}4`-WP+ww%8bnC4W#yT#p(ol6EY&#Q&g_;5tR!k&99?!X>s;sd;|H= z8k5-AjmeW9Zf9X#IJru@AKu(WDQ!f}HsGmostO#Lv#(QK&bv8t$ctHbNYTQ#bQt=_1jJ__6OIyx^KYX0j^ zR3!d6f|RIN6_o0X%~Ln?&Y`=`yL7hYW(93I8SVMv6pYr17o#>1OQl((m)E1nIINBE zB`GenW(6ahTo2{#A6jup!=pb`6~&3V!swerh$64Ex2hb@%MmqPlmyN@&B&!Kf^(CT z{bfCj(OAW~Zye^_4O=|Ae}#!%b2)#+PRlOFE9}p#%9q9U_UbFS3;K6#heA>EhxBZ3 zsEE0Gfnl2&Qmsw~jz5R>-O0@iz2cNJR@?v1sQzm-(mdnG#Dr(~kz(eI^0cw>@$MOu z?K3(Z-nY&;V-+7$XvNLYBdLnC;%T(vHa7x(J6{$rVt{nFyyo+HwQQAR3iE zXiioZJf^feIsa32)TlbqSmb2h$t(P{s&s>tBvjbq4(yTYyQ(w-9a2lR8WiaPp0sC# zDC+m=@mE`?&YIG&?PWWBPe0L+IcG^}`anTOMSN*v2G=x1PPen-K$sni{R+1Nd8iAh z0#54)7whg}5dZu=j)u#4r>%t0uqZTK2%2f;NXvsN>qdEY1BZdEX_b-5R5((6wIe3> z1wQ_ikx>37U01-N9!P5p5N#AX1Hl&s8dcD1X>Ofd1sSqZrR1TysXD41fA4I8=~S=o z@U(+$T&*Nb5^s%+Odk9bgRrdP44Zv7_q8|y+LVImIA8!;cBHmNwClXCDUwpxh&xu7 z+j(x4l~wc@ehkr15a({Y#_MQy{wQ4>`raAm z5fwMo$w74jQ(!qdbW-)}Ui^TJyoAG4-yG>h^=`zD!gO1Q^WXjam0DW;;coig&1%-k z_-1t2Nv(g80`msa`Y+z)AC{JQ{#A~R#o-nfBcKsXkl}Z@x;acR$)tt)i zxW&*=@^*yCt$U2DSEK8|6!4B4noyL}r>?Ljthneo+=`0rR|G-y@ta!EVF$4lalMG6 z6T={pSkXX|Kx72bP{3N$X%WM&m`}!~dXrNtL(6VEt^&}BeZnW=h&sIUZ+?0ev~Y;; zqHApsFec>T5T}3VCh5-aWTWJj`w#XH;^sSuX+Y~O92_okK#g7V7e{VWk$zPKYn56t zZM7a-?8f!V4xPi^HYS}MnKt@#mD?Q(5`ddVLf9^Nr^a^d7eJ-%OS$*UJpNwwsw z4iDgQod4Lr_RTca=SR)Q`nmO|6+fV^n#DW-K1D6jmc_T(>_aVfU0hP+gH)eiy!n?R zv17ws9`h~-cCV8#i$he>P_QPUA}OH4!R8@iPDneXmN?{6Lq5uN^!ymH2G;_QMT3F* z>u6N^0LHF^6;Oi)N#-W(+p@-MA*+b@x}MixhmO#$(1%}ZXn>UdY-c#gIWw`5ig{tnsbR{ljW8V) zD6fIRXexKGX_l%P{S7K&)-BAHknxATkvqM3JHF zf{pMx(M9Espt$Ch$)3>dD-;?dFs(1H-8X$8Mbj$T~Ap)_qG>Idh_RcT|Bdj`nN`5sA< zs%AV?tRf@9AnJxg84THkjTjbXnje18Zy>l6pR{F*s7+YRDQ<5Cqk?nyQMw_L@-j&N zf={u|135M=`6&16%f0w0$5iEn49uAN`M=EjagK2hWY`wsY#Qk`Sk6W(a{luKCq5J5 zE~JFQkdaIckP8>rT*TNPdy%b>F_vmGG|7ic1g+`TLfDubGVJl2#rgbg7gynGk&lfH zctt4HaGhY9mTFd(*Oib5;XNp0BqL{O92bQF=) zh%H@xT?$J))f+7#i=l`C{aWT6PSc9k*|SLKBH~^^rE$u9jiA^TROc= z@7K4yXNK~v*wUg}`uvS*X|ZaFl4yW7pLTwd6l64#R<fha`1T1>TTCgfHe7;@rR8+9#9V-8s>0woGr{?PD1n68 z5|1mFV0FbpzoKhPvcp z$qTufQ-OX22bgyk=3{x1;R2>22=@nt^KZXf1avUs99FM%kUDw`Wshxx0I}R{F=RE6 z6=U^0%hR(GXB}`%elv+M&U)O?$9sHOAR{cuP^I)Y(I%CARQQ=E7cEJd6m zP~ARMpqr5gL-U6tf`dX9J+i}&lqs;&>K@>9I5tfdj`55*Ci8ySwF0m+u`ohLT)OKA ztuKuU9nJ{pIB1jX4#?_HIV8I#;O|V6HGtc>tKsb9@GgGSd88 z?*pQv6}=c1?+QmM$1X@8oiPn^$7H0!aV*{=o05ra{B07R^m2Bxnp8r&E+E#};J*hD z)IBZBS@mST+6>%lsQO8!Ty#9=9H+LaR_U&*nYOa1FXzHW7OTH!0) zjFfIuB+`H!YaJ%GvtYeEvBpK)aDnSrfZcX7T2vC;7)q=QWRFdV!4hUs9U>15hhe4PggLV>WPwO|u9LWmhN_-@K<%TMxM zwtwOgLqd~I?~!Jm=UIwC)bW~Dm_qdP1d%|ukFKR45i`bx0;42^SK*$mT9gOt2GZ5 zdZIJ{`M;3Nwq?JLMFAo_4lEDXAzzody4)Y7NiU=ONexMbRlpL^%u3mBUxWhF+^rxG zPfuHyMsTlSgGawoxCo8PqbEJL_U3UI@E*D0EQN71ye5q|i8jM^y2zg4aQh+fGzqHP zq9a7?Iue8?K?5?$GsI}rXPQxJMXYjpkryBGQNSEwrgkwig2`bMo%67;WIF6X)wuTe zn$KQ`ouIyvU$oNl^plx_Y!wCv1v0_~-Q|dm$i5GiRgM>=U%%hDSXRUOb=(&68f~CY zo{8a?Y$hX3i5h@h`zvKP(S`vlo3bovgu?xN^fnw}2$hxgkY=(nCmllh9kI@@WLwoP z=33Q~WtC4siosSZ1;wjsj)&1;d+=8_Dm7AeTBAddu;R?4{4@i(lYIIK1j8M(b7V*d z=y(1)%y-A`p2GB4K_R0~-}^_R(MfbVFj@S-i~PXG?xBt`4KK5Nv%{?M`V+dFe?36R zCvrl4SBO0kO|$lXU_wIezlZVH?ps`C$^PxizKBLip z$WwNLRFL(Q{q}$3dZc~fUsGk2TuW$G__wq>(=nB=8Qul$=1FRK9aIBD5q}3BI()af zkj&a5R8UN2{<{DsS3m_5FHw;5a4f=A{OVd9Lw{cNH)MWiwP^BuWN4l5)ghR3I}u4KB*+`K}6vFX~-=qN|f%bOwQ+c0AbLualn zz5%Ns+&0AvPeM}on%ch~-{>ybZlktF#&%@eq>+q99#f7s!urnCh~4>IfklirY}cR_ z_rsxLcAzDIf)Fqv+K@jp0xE-(gB<5cfEkB%TPZe_rO-7TIvcFT1qwv7(OKIl7O_QU zOS~Q;@X!Q}L{G?k&Zq~7iQx(OWFo)Urec-q5#{hj$ey8)NhSZ9ruS2Y=b6 zTMW0vE@V*$h-(vUV-BAbLqI&oP;W;>Bit&h7-PXdXGP%_TeT*M22iy6CTfd6;gch8 zvDgF$J_OKBVg;t|)Ff$u5_=LEwMxM_$PHrKKA`GngoE;l8Tb@7gBG)2cEcKl4{)B_ zjo++7dL=q>Tkq733AuU@%A0w4Te^7{v`JXKOuBF%TQIBx3>@3ABA+U6x%T+l#0~M= z^ASFUc1L+wEd{kQcH|^WsN|Tm9Fv76uhx5wa;Ru&95N#JcxJ2TxRzj4T#T)N65iAy zJ5X6Mpt54UY>kTKM=lY`uUMMliLwzg6_BO^S5c*4MaMi2^BZ*>rmEbYDxO}M*f0@r zoZ9h)8bR+&h)oCEPwj&3C{@Wh1f=1{gzLn$!}FPMbNrd^FyF=KR$1OTxfQMD-p{I) zy8sV^6PV~TjdGQO%XvuB4c$Z&zAhI)?8r18KOkm2;P>U1wWU%;RGZqQkZqh=P3r1W z?P0)lO2b4M3tD z2s%3z`-~{?8^a$f6|fQhp0Hs*7;)ibTSlaab~d(EtBvqjTD6@f?U~hOv^`_O{ZY@-S@fLnA?9KncO!BP;KC=GYKC7n%@a}$OYJ{!NA2Zg;9CX{HF9|oL-GL3!Bq?$oI&6pkVIrJ|ujBI9K`$H^0kcx$mtX{a`X}4<-B3Ecmvx6}D)F zB*+8pT~fYXlNOgMAA?W|2Yd-7?0mdj3VJxLKWmErjzQTr%={`WTW>YD);hPVZbNy@ zQfc^hbV6d%yU|Y)o=}k<3EIHgP@Fb7*f*&~i1_i_v~x1`ldb{fEjh?QuvIY9;ID*H z#}A8ZGAgll>n_0f`}QHFKtUGfHTo=Ew3$E8V!f~&!z2CK&*2#+{mSUhj9~qei`g`7 zSL+~Gc=)z(iD@Vkt1WD}G@wfIvLjm^&x{Skg`XwDE3f^xk8w#OB1($>^lCwFOQ3E} z^l=&}*K%#5ZJVdNNk2S+5+F$^q!227j3pkDHv} z%g+rgwf<&ZQ^YgmAC=#fvrVv8phiRyx6HsDVKAI4HAb@zzN&pP{rTEOlO(m0mQGAz zN%c-Rvq7@kHDFk{_!t4EQ2|q*gQ5fs=000Jj2U8bNC^u?M>Bw= z#8qQb4{=PeXJH078IwI%UOLIQIdg_@0RG~Sd1GVTz$I={$Tw)smlF|1r;=XMyzs(6#us_&f$E^t<>YoChm`uocN{I!2;B=)!yHd z7N`1T{-#zL%cNLqsG;2HMh+KF$_Z0^F=Z97bEP_Tk`}LM#8nZ#Q&R2>xoYAvr8@zd z6fa@$vzr<8qgfaZ1YOwTC1H&gFTyDb_(MD)DtS z+R29y;{0QI2RQd&hl5UhEy&e7vW_??sCBfgzEvKu4%zNhvc@2+$2J9^8=L}{aL5mE zh<0H(w5g~unfMH)kcQ~S7>1Z{vo>xO~(F!SWfdJ`A`bSl?R?LFQY2Q40!Of=pt_F!mNgaG$a$S8P)W`Tr*O ze4$)em#$BQL(#{TY}Qay^n*pLOT78EM$R+)MyhzSD(cxBJ~T>8)>Ai&6?t(!6Ky3( z@Nb;KkXYvIWEG_X2Fh(=P5Ah&d_{?2efTtHL%f2T>};q0eX9SeByH8_@+bBtv$F9| zo?Augs0i?qmShhhy~j)6eMv%+N; zPe@+C9BEa$VkKO0WcqVN5owj`{yg%$o{KgW(6Ll9fyjTPD66ONzO#83fA1i9gl@t{ z|I*(31Ze{nlFi-jk<_&?4&QMM%f@09ok16wsibq*q#*a|`;npV=*rb&=30a)a{wOz zRJ|a4zy5x3==%X1?TNIz3J_}tj?MDdw;@QWXC|V_0GnDRB+rQYx$QnYh^xvcYE&#-&)sxTQ99^2h~pB zMQuzUMD=%d=Wsk%daMcs$%1wj*AOBi)CrZlpYxR zK=6M}U2wFB9v+u@TKM+W$R=e4CK80rV)wJzP})kaUb10Yx+l*KXPL2lWc5{Y26kc# zSfbnpwwPd4qqE|_aNUF$8F)5I3UB&eLYKNBg!ft4fYBYLLD|wt0l^(Ulw=dPK^q5T zm_-fd*(UTQ&g4k;U^LU-8>TZe7W!9V*~rkPv@KC{P|Y~|pt0iL_26i7Mvz&Q7ufAI zKjnDw??e9@@U!AJhC*&Ttw#O)opyM@H+ym$PtM6Ecyb%)P!dQ8h5I!1!H&rJ+*$ea=TnM2 z-|OfI5}^aUUuTw=bF7OU^3g0ZHJZ%3_#6XV)La3ai&z{?GO?w5dIVTkpw8dSZ^mCp z6YW^J3C2I|3bMk_7 zs0vlVv-0y}e`f))_biK<*o}}{e@ze*P7XMy2jswF)J{LMf6Pr|`^F>*t9HhmpBjaX zS!bs`{Xy{I=HIlv388jTave^gOJC=D(GFTR{d_c|VEim{k_0zvt@oxR)Dfu&i)77(u8m5p3yUq2Nbk> zrdwLA1ng=(8^D{kh2PMVw2OG6)RTM4aCC;ZIA^m0V^#C#m(3e#{Cu0kE@QN(=$%@Grz1aTJDJVY3XdWDqEfU4Ezzgu^*R-rnDwBvzK|j=jd74 zYY7Uz!-!_!3}$P_)$g>)8Zk=LS~2TOeo;gd=om)5ni7_y6$Ry?rpq>qR!p5D(+tz# zS+Z)i$*UmT7OGY2WHb6#3w%4#W&E8wGZ{#q71z z)Qa>OS8KJFwL>r{4mlKuQf(SlTlrm#sHUr_9)YNj^_(PgFcx3g{Q(Tj9;O}fINm9i z%c!u-vc0aqBqyFEt8(&z-sx`_0?H2_>OG`ZXG|G-$Wmplz7q?t;VndD-*+HZD9wgxFywlZCm;nNk)h-azXJV!{i8>@Sjka zwv4H19|LY_o!mLt^ptCD&;`jIdu_X|=hyAx=zM<7o_Wcy!qQyO1;cw8TV;`fzC|bI zbWcV+-Fy(4)(Q~MPg^_aJ_f4k`(CU!K0=f8>r5K4tAZbxnoy3{(iZ7(PL^0pa3{6o zl1cOJt?+cf!mR_M&0r|pW;nNZPY)kIzxBkVHra4RPDr~|j1r^?M=+(J*lKniG;0Cr z>_E-Di=bbW#DxNV3Pp!0i~wK}Uf%K&Mj%>VCcf!nR@}s84g$}8O-R=Hd`}PkMN5?4 zX5nSJ|G<81@avk^lLLD9QAzPRO)~?A%NxYaTr$|wkx^G{I4+eOOSbq`l-vz8(}%r? zN^X4S%fqg~Z?qbEvSw=`Y~+VV5996>-_IX#QAm%#fbKPl2UUZ#u!2i^KyUSV`HQRC z<%6nyik(ij>a#u0jvWv)rmeXinxA%9CYE}qotLxqVid{D={#dzcj(V$x)FX}IbU=`}D!U&%R8I1Lsyv^M)%<@A|1TaCn?TgrwzNB)>h{UQ z5>PpF!K9TL0XN<5+Jv3;ZJ91VCeZkbth2e%rOB_*1NP*wc+(K z6f_jgMWp1Z1atXPVuPR+(@>gc;u92@E$E0zGJVEg>kYK;A69@31O;NQM21p)ti@i- zLg(c45G;6X%;xyqO0X>f2K7(C5LzZ+Nb0nL%Ts z690E*Lf908)s41(G7X6mw?ogb0=1Q7AMOJQYo1US5jH;dqIX%Lj%0TY8D z71TwOcEcrmC2sfRCRfl2T?spMh8>>nDnMmW!M38F#hKj>ulD`^U6~?()Kt3u5u+lP z`l?+VdFz>Yruw6Ab}atWVjBMC@ix^j`>ear?if6J=|B0S&kY`ZHPXoE>ql3>7tVwl zSXDHRCF2RnA7l{51wU15v$VDhg2Wga z^dz#E_@lgux8 zi9n06Lv_K+00_U}#mQVN4*w=Cr^03eIcmMO4r@J@0z}poW3yUuJ#f^=uoH1qM(M_c z%mE`PpBq9su_`sn=PHzI&SeDcek8T)vow#H%_KqBHfH1?_dS|rN^n`TTVu04h6HXz zKNv-tC8MXAy!b~vbL2$J70rirsQ9ekGRC)4+}(h%~g+PxY0xoeq)!Oa6&7|Q@nRshtN$uOoNKMw_e#{M3lnpr4(o(}kzf-5dy zO$)Bi0>zL6fPbNSXOE#EL^1!2r4%1(7@qwvRKN?rz?VS_^SWoc``uQi>$4p5FjE?E zW-4~C>%oU{f&*)S6IhIdr%y(efK;Qol2;R$N zpA+e3BH1k89gky{7_9A2WU0h@29>Z`__rpK9)iZ z(GthJc&Bx$b(yM-=OX7Q`dlu~!K%5HYo4B~O(c){%oc5^_ztUtgdo#Au6U@B~GGDMSPIa@-i@KY;X~!_A zLGLZ*`|{AU??22ULcTqCB<%05 zCTNH8vK<0Apm`#06@9l&WuDKg;*Tllh_uDOoX}xDcEQv0p$4%oWMEPRnMVS(HU74=swS-A-4KY)vBm96-13GTTmo& z+l*Zf(mMK=DVB;HB#^0sZxdksK8ry~Kr^Qa+IIbn7B6p;2r%sJ80wuOccMN-FN_Ku zRK<$oy$#t0=>OsGVgtA*a z+-Glq8MH~EqGL@FprR^76E?7QF+?mr6S_!jqVA0+{4Pv$k3g;1{}?MeEsjDO!azdT zr}%+ayX-6iLQAoLH!CE2%Z@8QpKQo81%vDa^^h#kM6q5hr52;AMgEmAP;4HE=`)w3 zMT`hgmN6*p6JbydrqWdEWWb=b;Ttd{jza#Is3R}lm4Em4znrcRz`MxW#rAqwctY9sjmk(`g|hOXfa`s8+42t zIeIZdK?7D{C=xUsaOf>TC26$MC1%a8z$I-}GN z8y8aaynHKT;JQU7O-JpXUH1p7)~G*qg%;*5P}cUhg&0%uQwwJ-c?y+QmRem#5T%PDkCF}WToHxNW4=*$@O|@o^Xh#UG z;dm?jki$|k2R9&1d(XNHymMHnEwwN@;cQmpCqN7kYC~aH{^dfstLeYsCNr)As?}0! zWzqJzR5yQdlUuS4SOScf`J~NVZKRB13wiieUovfwiz`|fNDPMcs!0@MkccQRsTQ?7aE3qTXi2F{WGrs^eHVVv4$tHlFT1J zxOGV;HM_#x)`a=*r8+2GPQN322#om(DG?Ias1WCvxRzvM5)0~LEEeh;H2)JGZdH|; zgoO`!VV8 z095h~sX3$>OY%{zuW(oRd!KE_7{(xI4x+~CV7ct7)ug1Q zZ;VGK*~Y$(=2eTS4(k+TE;OL{I||T?i(YE%z?Q4+Mp?I)a%QB)!}JzzNnnTh1U5G; zYh~Fcrd#i4UH>vDR$A3y$JAqV`18>HX+-#IRPqk$;s{=4QkvbO_)gz2Oae1dpM`4FPINua5ihxHZZ!x)Kt!)|^1T+lYylOwYy5b?#d_mn!Up_=Jg_pm< z#qVE!H4WeAsv(&uZ~sewcKy(^Pm|J3;oxr@diK6p_perXcJ(*Y@XOfV+hTjK9eVbv zxHoy@(6a-db(_@nL(je(`*_>Xv&yda_MvB0d+!)}R>6GZ;Mt6%SW;XfKB#rbL`!(( z+p+T9q;=nY3=v<7ye}>hk5BVWkguFmq`Qz5-QLp?aHO-6W=i-XAgibr>F^?Vxr*{l zQtVl6K^L1#1>uk6w3fOSgQ=?4M5FupJZ(jbUz=Tw#T<+|BUAtQk(fafxc&i^bkJiZ zoz$5!B$40&%U8BZTPCz|iK<>#UvsJVd_yMkE$I3W1vd(oO8JBQaHFyluss^$)nX-W zE7plyF)qUyw2Qx1z_h?fqj+e~?9N0%6n)YMgHwWm@YC7(;R%?Y_7tYskOYA?1R2o8 z5TZ^v9k3aq^hegthO)u#+ZdB}A>4my3O8>oz+;wm4Iwq;3>$lbIh?s^2N7m9_@<*npv!rO+NN?yDXumg z7mQW~HCNiC+9`@w_r^ROx6BRXX=AqdKeN@+=ol><7=~^GitQV?AcwA_3EWg2(VZ+2 zB=*vl3+pvYUS-J>#&5}e8>gYBa*g2F7^e;aRnUlMg<=m_ZAFD`Bp&!y(7h_61^OUG z=6WOjf{$6j6OoM~bd~Pw>|!Q_(sG7GiE7UVT8kcW)SK5rW=yDnTGJ!lfl?kY?uj_+ z35}YGfOu?^HmR>&(Z~>%McQO&Q;Gx)n8v(0A26Xrnn+CqC5jX(51HoOTVb-9J>*t@j|qi-V~c{{DT7XrK;)$gw#nb&FQ6g8 zLg1?q_080eTdPN#a}gzsMcQCgME4o=;!Iz*{VmK2bx&+;yK@~(Am`6C!sk+PHE83T z%3}c3qAg!kc7f9X4tkcv79kiIP)6}kI#tW=^s25QFW#PZAD&9-r^wq;C%{RRHs{#sBat=Um>0ulM|#k-6#u=dQFl5vo;mxitmZ)Lxiyh}0jK?!(-T%|WeOWwNX47ehyG&3- zw9Mp?OG1M*B$|bvSGk~4Z!*=BT2nLK5ptS=9@Fk)0Tg6>Hyc&B7WQ6ZmwvwXE3BO2 zHI-_GX{6gdo*Txrc*Hn{{{qvz+wgtG&51odGUwTREm<6Q{}0MbTP$#wF7-`*`t6ZkgsP*w`B~a_~o9g;{!mfOLg61fore5ie&MIQwWLsde0Ex(`Qm#8sH-^4Hbv zm1-slpV}Y|Ok9GU^dCcHY!|Ul<_LRww@tr32)(+TTkCpynr&U%6XOLmu5bP{T_}o> z!D%$&^6UBFc^h z_E9}!A@Ft1@_U3a(wL5gag%HXFiIY>Ffk#^1OfIqvhI42hS~`~5!_fLx}igGW1pm& zA?-~ei0L9Lo-=3Hlj%^2Pf>CEEc@e@SaIV}MEsmxSgRE%5zc*NKBE_l!et zLeej|vv#EGBn2zo_suoUUV>}e~+0 z3nVdbuSx54K4~T8GS}1IvW5(X_6#aQT6QkB{_QrvR`|BjEhyLwxSwzmY=v@HIFW48 z!c*4VK##k_{;MDlaR5UYnvY|+eb3b}}wppVyz*?~n{;gjls^S6)46-EDxa;aF4C;{~=`OHkX=Rx537Me!1Qv3S&D zuvXCuIq%Q+`#fvSB%!7K>kyK)*7N+X-{1H5z5l*HMt+Q0Qs6p8t7gIvMs1K~IVh1- zFEQ{k740!!@x81tUFP@`OP?eFLx!A1dLudKc(^Z;RYMGeT><|eH*pOgv2Gz|GGGFK z+r=2AI^lf6QJ5dQf;ak$td|LC5$d#5T2G-#3ld~lten6t#jr@YQ@urtPg+)-{k*jG zC!Lw5B}jaS13M5Fgn@J`YX|+ZJO!ihGWJefbP+Hu?vds36J8@G*;d8sMfVaipiu}r zbi|1ap|TV45`iQHg}V+bham3-A?3_qgLav-kgEDahpVqwHeLd9vt$n=Mg6B+1y^^J z*i)9<^EZ_t_`YVKt)6q@WD^8t`nC^$^Rw^f@9LiJb?j^^g-G(&0RK6ZJNHenxW=Iu}l}V$4AJGv3&0yRu&YhF>^yUkXWeFV+joR47Vpf z-dj<$sFdDawC>LTC@ogp(c?zQ74ISVO#`1)8=d^)jjX@o;>i9xe&4Sa`hE<)`t|TD z7CN}%lk`TUsXmJdROS_f0NL=%G{0ieS)qR8?oYk~{@*wvn%ONzck)BflGYKG;>7<* z#-C!j3Pu@!`4Z!-3ogg(C9C19wy9$S)wGGhM4;O&1oa*r%ac>(gRuDG?_|S2vRE0Um7mj!9VN?rcZxnB%rO$vNP0*#D#Qn)SHqI^H(IemV+iN@&Lg}xh0Wx zZ7DFO12jT%4HAriBkAfG&8BEVVA<;iUqTF;Qg)U0+7c z>XImxk`GU*nMx4e$lo}V_W**S4#L`Yf)$i8rQa!QR(TEa7P`Hj7uy*-<{*u&u<#|V zHPo0As{okxG8`bkfCCmfzo4aN(nyOWu+X$wGa|j2ysxu%FOsknMTGFHxKx5cw&%!w zBm~lR&34M+oH-1rv}?8G!~zJ31dq~_gki-%GE3J=QfgDOb+_5BD%&$m#qYzCnJ8`9 zqt=?FyD$3-cLgy>;TIs+-fPZ59V3p@fR7)5L9JA#Kof)|~FD~0@0?-TZy##x&7 zI)OB#CcMcRAGd%;D-Hskr1k9x7xaK`+c8{3`B?#_NM8>1a`N4&fipZWUll&e^}N* za(6Gs*nYG9RixcYx?WeVp6jv4BVq+%V47^oR-w7i$0A)?$0G->_6ZlzfnU`Z6PWcz@bV5Iso^B~ zWwuu34F9p5p@bMck~AZ^yX14n%}nXKV$sOn&V9p!6|19@nnzS3c=YV}VYpZ#8I(@K z-^TnS$9XDI`K`5UwkQvUiMc0^)^otUa_*y+ckt%(0PwJ&`kISd{$2Ik^;P#Ry7Cz5f% z&E(#Gt(51Y=$E_LH=)`7;P@M+UW&w!*>~*_Oa+nfY*Ai$%svYG8$l%nFm@Hl)8O{}6!C zfe2eUw!+%Xj`6|BctMGi@yjRS7J@XZ!O?VWP{m&2(BTY!9pTF?LpU78LM5EQkxCvG z4(;7(LVui2;p!N%@S+Q^0qINZ6OE z!Uy`%Vh|nN2Z$JsnsRoi`{Kl`vOkL#8AluIA|XS$zHd}8I*g_%T0eqBD6QyR|HiDf zJ&-VKoN2Vah!s$%dus-~E}GAZpCMPqy73A0iA6NPb~pq})oTO*oJ#DNXL-~eCosTw z>iK)dleA%E7Zh*e_>&+WOKC1MNVT$8M$Q3h>wNkfdSDxHBf4_0+?!F|M@k5#;t1I6 zL=5<&ApOogqI}V|EQ>xi^plm~0YoNP=MoBu@H7X2x#ymxWddgT=iN_}pR8m2mN=z{ zmot`l7K9<0evRW(97}eAPiF+^KJS5#yl_=Col2(se2WYbn0cTK{)8kp1V2Z%C8cuX z6pYOj1~Z^UOt1YEhD@93WFJdqM1_7$C?XvmAzU`O;iE*Ph^JZ-{%&Q6Qm<1pX-la0 zvotc!iLOG_!Z!}b`QvrvEhr!xd>uqEu(Uu$Mv(Ca(i9Ae#nSBWjLky7NT!2{fsn{? zT2HO?JvcxFKp6qd31DrhguPyA`Z49WK%V?`WqX`=bK?Eh-$&)l$?`sw8c*q=8d^-s zO09|dajjy}NVHr7luEPboAXweTlbq{7#y^Dv#3Mm+BR!#%&b9Y@E%!y{3TKLeGKS( zEma%@w=RNP(#VbbvGOZ9#fAesiTC%@!~I&g=}{~VkBwbM`^j|e<|3ND=)eMdABzKT zju=yj22^%zKfC)T(KG&QDc~j{I=J+|8`jzjZFyeoFStV>$)@?iPwjsGYhKBX4m~jO zNRjSw@Fxq~A(f2DQ(_FqQMFiG=rM*dmBzt(OH5oVl1BMR1JyK&bbG%!*+*>Pco9Y_ z9IIBS+_O^SY#cWB`D4*SLFpvSvvjlhn*g9*H}a3NRN9)rg3kzoFMvdeq?#5^EuEa? zpH&Of(JSVT4Ci%nZ2tmbCbKYCukd@WppVQk3% zKt|7GDq-hxOqN%?fpVhxsrdSSeJc-8lwlO8gl66XpJcyJOJa{?q5WQZl%OFmNY=A8 z#SdyysX01%#3|n~zTWdmAf(|}Mv4JgaF|><32iJlWK(8awIaRZCL9zts*Xjq@>OB= zoy$ZJw2ufxEm(FQ&0@%7taZlEYqlUn0!)*3Sqe%&-H z47nb-+@J~cTwKKoZK*fYj0I7I;8y4 zl)_RAPdZ-*t~FA9e{YEso1vg+u+ZDW{TNiphg){p4YO?m>Id^@*jkM{xtgP zTq>id#f%F}?)m2^|1CD2d-=0pYb+9;i9r|k_#eX|{2lTQ0C+feza0{EE2atLz%9Nc zE?km+q*9Ji`^o>Wl_V-j1fG++9>ld_j%8q?yXOKiP)+j{xJ2avP|&YZ@i!sb2swD# z$Un~gRem21UUivrv|`vn6-dd*^7~{bk-x>q~uhMOK%T+Bbt2T%4aki=K9HG{_A3p z^qczpnFVLt_lPOYJ1Sztm3+^&6|g19#ZjPTy*epX8(} ztyEs4L3>hI%O-OtD~QD5{)gf)s?2K)Rd6Yhh-EAH(ZPKSQUM*?1}dPeNJ7VFpJv)CH6rPNp0)-eM3Zp!ejGG-Q){+0WhRkk-+GEqKu@*m_df>ctJ#i`Z zH6{JYZ^5ePpRNul6{wNgPX%vrNJ&AY@swCNHrEC80#|{}Y>!n~h~i@xu-!mnH7! zS*1_OWl`{2-3_d^Y2L%c4r*DLjfiCr*yzB9?SSnV_p~+L;!V?)-5S|i3cJZQ+Y!%I z2@Qqx2r@@XV_0m16t2PYQ{)EB%?Mm;4h0D5fk-RN-UlolI98^kZ{gz4I zgUDuHN;WHXbyq>lklPkU1C6#qe6{JCn4JOuLbI;%n2$y0@?Ag6ekX=WfS%+KGYcm*e(=a)t0~+U0Vzcu%pA$ zDK#nGC0QBa`s}Tt5iDfjWSF>=c@t@W%Rw0EPKaju1kZtvB^4YwTx5qgkyB+<%wdnN z#0z%4Yzl`Wc53q^9Dc-!q+8PN?Q^*TWfb_E9ll!(Uge5dxtvE1-<=T+Q#uXH3Ry2N z#)|wk)(h=lr=WoAHoJBqV2uFS+8Om4>bK;ptk#Dyk0fx(Fix<<(9V*6;K>d7X` z)>Z~(${0bb_nQgx8mA}{)GeNT)i5U*>iUNNt|Soq8Fh%;p>;mbTIak)Z= zBQAC=VW+v4pvvdtQ`%#*s&J+^OWWZMi$yz&;j8Iu>IxEIO7cJvR#9z{%!V$B1AX4s z*6<$r<1!YOZQ?tE1FXnpa_n&t+YMl_nzHLe8vX>Sk!^HZH8v9UEbQk@IO7KV0m?9K z_Mp%PJ)lAxS29LGGGgMELYDbTS|`Lr?@ob*{3>-8mU}@oSi3-u8Ps~L+`e*SiefU! zk;CU9f=64522%JMa1$a@w)US94YKmJWB?#(EzMk?~s8 zgZfJBgc?bdMIX>Fn92--83cQ4H=$PuzQ8SpiE{!~SRcgDn6j>yE&y+%1WK12pW3W| zQH(7q;!!`hEJ~V~yqf}5^Jv5DjOgth>3ccg< z>!IQM;K2qO(KQ+7@=QjyOwkawyi0%{V~sLf%AeL~H4z>zYTn0KHP5(* zjfXgUYb%wJ&-^NIAgseM5OK6V1PwXB7zq+s=}mzu*_s)jF`iYLwocD}Aga{Fv%Amg?uB(``BeiT$@EAoj{h(9HBIb|<~;+dKyX$5=rU5XEmL$Uvv`y9I&Dt|n;*5a zWqe;klqK;v#ZE*=PkR|_WP0<2(Pkz-atDcDnwV{ac+gQy6g_1D*eKNiVBY!MvWs*T{C>fkm^!{Pd zM5wb{poJfrVbf%L2cIKFejv650|ne?EN|?A*sOb!Pvq?q16Az?I=O|GmftFtDzim9 z{|+t%P>n2Vd==geb_fPPp8or{0(tW*C@_i-YF;{Qs`7Z)A5)=FcM?3*DC%VgogIA52cqYaid zm87|;B+VUEP%<=wc!vZ37;?PfN`eq&S2_>s%*Xm3qYY!1_PS7Swskti0xME8(GIsP zrU+U{Sg5GdKj@2O&F(OlY-owqyS9jQiZ-UJd6t$HLm<9K>a*Ejqhge_&YGA}0kmCj zT46tC%RtdMb(g>|^p-#czdkxDP|bn$R!189fo)+e%V0Ow=nxVjPi%1z7>V;;Ot0;Q z?Wefo2035b+52Nog=o6U0LZvt;pb!Ppo{#MsS(aAe>{U=pHufd%n5tnEoZPVh;8Xi zxXfvZjA0|}8&o(B%8Fg1YQYY@Ipw~oAC{I@IC;bTAo_?e(+V8d@w|HW89)0&B##xP zc6o#!Rg>(aphGf6Eu|vijJ5}c6&!q9rW*jd9iz5l%&XwWLtPZfN^X z@mTz@6aDvFE)8vQ7D4e@$Oi^1{=$m9RG+y?7E5N#g8!%kX5g`#F4D zQ;-6d3}~6wvB>g;PTPX~iEWj~k#0b>G1i^VT~dDgub0kUB9U6^x^r8LJqdqG!lESH z|4yZ3$D36o*=rTUAe=7OP|oT&zpdc{CF4oBoWs1DaPj;|!xmkauAGsS$Ki#vALm4o zaoE}2o_jxCDpgQX2=e!=lv1QtV5n)jrZvC13{c(16Lg)qPXpjCM zJy$G?>(v8pW+?|4=JOCNRph>^+$jhuO@Y<--E=(C3Yc|-;#ppug?fgX0ONidTiBRZ z;(p6kl%vLC8bQXD*tDv^=H~%=th{t4aLNFt-Dmz9i%T?V5(1(+rFp14mT0yxD`O-s zH65a;E4h7{G49xqPctaVYB^WN>4uA%{3vcU2ZT~<;_&&i0hqmIEAjMc7FP-|mBzd; z3lOxW^u7DBBDVJYJahxPXBKi~^ZEHCBmOn}wHR|l!s;#F;s^I#4&4+AmZ0ZBsVslO zPb`=8Crq3##tAAFMstE6BEZX4W?NM-o* zP{=*HvlhN!7Ze)}LFyz*MbZ=Wq1-s$I+oMQ=Cx#5=J#R0g+k`%8NGyZ0KE?r@<3#u zgo8+VYE7OOum%Q8p>4#FBG{FoihS_!P{u^D8a4rbMVrTv^oFP_>DNhF_|i?*HeB3QbU3L>s(Cse?B)I z-`DihRwy5%>mtODL#&Ci)KTpP2{E7g&~>F;yGPDBM3sJ&KLq0T##~m()-gKYQ1~A- z?5nlWX}}l(C1E1ABl2I(aNK?e>MC6dGM^x)`B{=Ul20Z;G!(}#@Bw>v$*?tO2?z|) zp*25n66L>&LKaHnsamu4eo0}ve-3b`02;mxV!o=;*&3Fk6GKvaGL2TF6IBb}Bh9NQ z7szs6B+gmvgnfWh=;d|!F(hxQX}Xb_t!n&<2D_+nV}f)UzPncUuvcwkZ|mARLB_e$sLE_*F4!nz`ApmAjca`Yxx zJ=VOYmHxkfK8oh|-TH~XxsNzshX;)1J8L&nlq07@haJAzx*nNceKUs*>`j>GHY?k1 z{uD+m+e3)hPM%mlIx@|V*RlKlBAOvMgN(**wLtHT-a^Y&&zlDrk<^{+J z(qzcCujc2EbHsvX1!-Vu28kgMk#_zan2rZwHgvW!f%^!|S+jK~-@eXqz)Sf2hMsJ* zP3oA&2u>M763*2zU0d@NXIyi3HfVU}cOtAcR@&CaCUY9ng!u)sn;@w{G9MBMz(Nbh z*5Vud{w<6Szcj}gNMHytsDVyLQwt2Os{dQyHwvI5&Oi#xqWeVW<*e6g@l0^zx$jk@ zBxz>bxGJ$(*B|xbB3e?4ou+3{94D*x74$B{@D)sGu#0c(t$4EIRdvQA+J!3)v8lwF zV<$KEmWd>kB#5-L(%~8`J{(JPB8((~jPP6wU%zyYNw#^{!aPP}#YArf17b^kF`7ke z;-*JM<^qt3>E?eDc-ehic-!l!)Wq~!>GEQ+Ft~Tbd@E*(vx;TYQ8l2)Hs&wkv0Sa> z0nWKqz9>nM);th1&8j{B7j@$N5j*^e%tOZx6jBkT z92um+`LuV|w6S@RBdK72Vk3E>;5zwZv0+GfAQ@JDAnCDN!U-PHz;QIBbJK_I-v^Wa ziu@l?7|u-}O?sp@J2yR%WOg9(7^OK$smP}iQc->@6WGjHi>-5W{b*-?ghs+q3ZBKW zMd}{2M(y&MA&SYR!PQKR0&F~-|Gmxmctpu%{!?G;&KK|Fo>=D^v%)UFf{ZBS8sMd} z(ZKp!E&;IZhJ5aoMhq5hyh7dt)Bp*JFsXxo6p;#PT_iC9tQN;J^3rhLgE~s;423jY zE#3n?DydT>IZ?c4Q3-g@DJ6I<`bC6brQVv*3*#_x)KMIUv!oHEzop%X7gY6};b5PJ zp30ue);~zNV08kT2|Q~P17;p}RP3^y>L{5~gRi5_f_7!QcXLk^TW2U5yMKrTJbI8d?d6)Z#h7tC(2;~khTVdt^fIjKGsyaETO z_y+xh5eyElf7U}O_{hDjRnE=cQ(MX$Vllz0L2++tT%~`mK9%yv901mf?fU0cr@a*i zw?S|5j=p^z63LK62wAk5edJ;?v;tM-Uzp62Z6Ay6>BYRgCK2D#*DR0sWc;rU4BMe4 zYkJ`W7sA=Fo6#HQBvUCX((=7>Vj8xRP1O{IhwRob0 z4eJVQ>|aPS-w%lNvtD>R*-l)Xx+@&}p^leD-p&JF@q~5%sQr7~{(U&kKSQ9=x#Y7p4-m`) zl8Pj>S5jtMTMV~;{Tj<2##Xj;BuUkEzl#A|WQ}BM z#Rz@#rT+RpHVtJ#qc_&z5rSewdxRz8fwI6WyI6SO zTR*N59Us==rjS6%;6Q9HyJz zH7^<0ueYpj8*H`=M?FmO-kVmx0L+ zGPBz3XwAD^C8qCl7dB~t2GK@36(9I9G&v@Hl!0|xDxt+x3K zlD88|fFA=s>vO33b?S4XJ|h-a63Bme&)vU%Oo9`;mly1>6HFbk&Hlx7&G!Qh3445b zxb9o-c%8K!j+BKV7LwW}aXRKbsKx`<%!75OYxh%MbJ3e)_1m-6`R_MHMSxQf3Ow#-ex0?&lO#<0a;NDM;U^lrG?rn0LI`C*kPsC zFo-HvU%9G;cET)y=U{!2X7G);NGi=B4o4mC2MtuW)r)0P0D#avb+iONkJiyxSkJ{R zJOV)(ws43RmLs)Lc-~q$P|v?e8{q^8WXczZ>V1RzU3D}JM0D1hmn+c}sC9zhta+_k z=UTbWH7VE~)E}HO31&%5$p(p*p*2q&!76GC***CuAN_x09ZP6kLh-s4r!WB+8V>4H zdUq+jJh1T&X-15LrxR!a8b@m5NUL#3#p3bt)N{BHnEt0UFSvtn41dtr!&PI)cv?30 zfKBSbYEt*tys=|7Z!EpLr^B<=AWL#W_0{D7k5_HZ58FIwZQfS3d7x}_zHF1lT-3l| zP=|&M9JL1SsT#PeY~Tx`smq|>U>0uKp*y{mDqcy__dtS7x991B6ikNfy<8^%9jB$^ z^8q;U z!6&N-Z(HdqQ{PA$UuH9Mx-{2V^|n zkMdsswDSK>6sK92v)ki1-OD79QkV(BUjQtg-grwteM^zvXh$g%vLBgF=cS5tx-*Y^ z=7&Upr+W^E4R+ZX53hja;qEFO2+0w%&sTM@!qur&)c4+aI2?Z{o;g3V-gx|$L8S!_^2v{aTroaV=fQF$u#zsg1l z*<)HLcDX!VavaL$r3V-Gh2M~75oP4arH4(#EOGh)5h+nJ{M-P^RlQHdawgjgW@!G# z;eiY9jyk8jn%}n|I|CA`-S73?(gk^FRe0xjEUojDr71Rdn%RbbKnifUEEbHuUz)`* zMCWQUsE~wRxYl%(vMF^UIyVC)$^+QgRz98q7NXOH#&lm`&I-m;XbW?Xw60 zO?8V!ZSdu_mYqlPM3LHcr1S<3<AJL&!Ky6q*db(A=mp6Z4H5L7qLO{d z^Jn6b{aATf_@i94_puW;`Cq~PYF*V|$^Z#5LR1Aw@Z>C;0R*-1(fHCy!D5p2;_1P^ zG9)sV_%8n*&aw<-q2?#i8tWr6>9bBqdSy6F_QuG~orVBOsBxnap^aovjN$}l$pm2R z2B4%mh?YOop4a4_#0**tPN-=n`c0kuH^|iO-|ki1q)in-W!ZECpqsHO|3 z>rq^Y$kZ7Fx7$&wEX;9F2jxj0t&l$R?;g*U?NWNI!9s6?)+1-r6Yl} zP+A%HCTmHER6!suR|Ni&e~eWlat4Dq?UE%#xa6m0`9^a}`>TUge63-;ms^`{%g0(} zOJM_h5+Nx53-OZjoRR8d`RT8*xhol_4Mr=gu6O`&z@qga1cR=|Ryr>XXI23}9Sr28 zRvGTqD%WHH`XU)83RXmb!@EAALce}4hL|dH#&B~)Ns}0zp8(Oc2|mKSb#>qz7yHPj zn)(q)LD@h;c*=beFL+Qu%?u?O$ul&Z^)r4vM(+SPo(iq~zr-c*Eif11FY#5out@xL zu72BqE-IIg`s;iJf%2mIlCpWX!Iwq5QkVqnRR#o^u=p&0Hl=5_#Mboo3X(DA=_2JHG%X21ho*aff@r)P*E z_~8Rra2iXf$TV08*Mepr7)$E=#&kI7fy6Ts)JnmEj07A-9sWQ}Dr#@3BnND8`+H=) zCSSo}d5GtFEp2!zR1f;3y*!B$_vZP%+n6&Vs(#%xzgH)ii+KB>ZIfWi0DU~j$TL@P z633kn`gQrFY;PVHGCyA|cs@jITh&OtfvSKvu=tlZP%E2M14T+aJv=2|($QNMw$l-N zXi?|(Y&z=29NCyA^+k0s*hgO%mR zA{vr0C@nhnx1&@IZz`H)LrrT4bVj$%%eL-GKn~hE3PqKZQ&uBCuAmrz1*{ZfHzPhh z=fDCX%aP6a=r=#{=6{ZgfeOlj)7L z!)pfZHD!0>x7R+P+SVZEHdS~uE^D4ZzB{F+3~z&)564x_V_p-lhWGiv={1iou6h5U zCIY91rGD?JY9F=QxV|)bpDLwNV6u1)7)}KnhX7K5Jbf6m_`D6DWv%F5abyo;jjuei zryAybJTpy{kf7x)lT5E@%}Pte_KvX?J5YQxp}BlN5ckK*+05H`xVd}!AHNgbh#|c= z0CmVJG-th5sM<eR5sTY z=Ee9GDm_XWNvq@}L6@K)eroP2ym_H|nyD~TL(ZWd|1MLMBekRFNy3wx|N zzGD5d8ftxc)z0!FQ$^hARYi0Klm>S8O*X9&$R!%B*uygsAA(8t zQqnG@><9@mAwdsxEGM*aKPgoS?^%E}XsI>2MtJ8wB!h~$)#aC9fPtW}Sxe?37fBZ* zgmS_tmZ&aI2{6!*rAG{o0;>dIeOJ2U?@Jn7EQ(6PHi&BVqXsO$6B?Te^b6 zj3ZY;K9L>ut#`NONtR#i3tW$XQP7q=M{4OK!PHbU14!) zx_{{E!f!55+y*Ls|LT5epW&DhQUoUzBwpy2afw=yG~TOGN9N1>wGTWqe06<}+PRHJ zpNarc>YGT_B;{Z*`R9qoG0l_X1`>Tt#6{&KR-A_MM9yBT19H&qN*_h>PO|&cGJ1}P zQ3OqMfvrz=DB(exKcXej<9kQjiLjKCyd4#E zKt$$MQ!CajX+l0+e=PaJjWiT54EWZgNp_Y>gu8()l?XCy)kaOj&=7~m=rs}+-c)Re z2)_^r5&uLSWMnXb(7-BzkQYS#RLWrXzBJAhC~bg6BjZj)4t2qt`Tk)1GCEe=9%7zF zjemg?Pv~X+)-L=4l!%m~TX{}GjIkJ!zyUt|xEDx^RsEsuxtE1=igdO&l1}N>aZCXS z8=kM5Z>7y*vF5g(;WrJBijm!BZkA_7`Vq;m!NyW6#A6RmmK@9HT;gs^DLcKVgyuE1VoH3-u&hCqe^2t}Gu6b=J9b|xo2 z2YFpYH?LemMK6~Jvyw%g?2-#_IoHL-{`kUUMZtDQ!bLX zEHD(=C~QPU@(X%sJq}+>eod8^vAXn%=vhsIb>*sy^1uqelz2)h2~qDfa~%2Gw7hTw~TR`TYU|0u!7V{ZE+*Xaq`ySs?F$?vWKQ5)cJ)Z|V-j z(T}JW><89>;w){Nt){F2XajkJ1F}{492l1WO`1KoG>Mf|P^ecCLN$*?P+jua2B)o% z{U2_IBR?#-#`XyD^|?;waF(|Q5cH^@I1`9^5&KhHL<`%TBi}O!3T4r8S<+qP&(T*r zqgD%!5h=J@C6auGYvvg?(2w)W^N*(4do#eT2N-6bzh*4C(IcWjD1{N*H?3hydnh zt)6S#Y(KO@Q;qE$qIgtIv^*@IF|!iJA2W&po6O7}i6~h=<-KfCR-VCYXZmj{$aMs;!}VoRyeLfOT*h2Fn{q1u_WPWxQGb=v4|Skp7aXTg~IsA;B&fAAwb*^tDvib zhip}VYghQl%@`5E(a8O?R*S)K`2GNJ;BN^B2Ld~o^NC@(j&|kLn1p9)B+9&{HG_by zQsZEf*tVd;!3&jfgVplB9}v+CIS1^8uMwjv=gA_nMc->(lb+7M+x0!+AY#3+j{@AJ9Hwtv-ylXbR1WU8n9+it`UR~%N;NW6PC&~P|s^Q7GY01i8S(SEKOy6VtC8qVHrMsK?*0IG_C6u&wc zM1_80q(&XEpCyrNqgM0P>_tk1;Uy5DH3CVbO~qDMjS3`L_LdfcpGDiIKHh(jS>z zi#lg~m^@z;!I{eddd5D8xhY2qr&LAtKsESD&6$E^1x^+S71L_QR@Tz-mGfk`C;V;M zfF#cPE>dHvFMt5OM1oPO^e?*vRfki1o5#O|$7B5o}X4`hf|UZSPs5HOdl6e>gk zAx=}n_V7@VLuqta3q=sCW|oxFYaN@<>9YF zcz$!foC-qv)cGrGK`07FQ0I&^xK=YRIV060ze&JGOf#o)#&p0LGvkb0Qi|nN6we|| zJmDfqqqJRow9L-tEzU?8Hk?mN8kxNiXY>~%!BY5^%h;)w(R}8Mm(kbyjHozLV)tov zK$a0u93<&!K{9u!pyz4ZvU@Fcf=SAf)%JuN_}5Mb3d8+xNr zHN$WVjZ=T*>jW880kYYd<+xWANmZ&HbDwt-V6BqFUyU_~Juw2w(7p(F9V5O=-<5d; z`v$v+_JNobp7!XR!E{c%rT_@;j%<_RKzd%BP z(AP+&9*b|F!yKBQpU>r8tcjCw)utwd0DqB7=cQm<%Re0hiCX?n&KBC6!P)N1^&B({ zAKb@LKpOt*lY*<=@}azhP&THJA5N^=aY6$DjFe3VSI<7(;1G8z$IU!31a&Db`U5(c zd0S!s$cReRCV3r)0qz|8Iq=Wu{%YBb(BIh(YXbN{?GD}u_haxa({?J%r=u97ljuEW zBNWh0deNNKC2?j5Hdw>JBr}HTxrMUwtHr8m4g4G=Z7;$$?@PS*$yqp-p#U%;0)DX)o%}~5m1ShRw6=s0Pd=vXrYH~`Am;HqLPFF zq)JGE&Gbe=;>sg8(y*NeCBl@*lzz?JQf3$x>;|)5@3StLHJH(sT@*9$fdx?!Gtk)?6JY0xR>$DnR z-{QlVI%OCbqpLb1jBGWxsB&FAOrK37;_yoe_fjJ2h^X~_pOv|8m3+gc5;xwk3&OE4 zNBRC3w!{xR$uF_(n}4W>CVxOe^QR78DnE=Te2@?M_d{vSJ_L;>;X%f*KvOGCsGpXSt!UwbvPcR z&=&jB(ii9qxCiw%t3Y<4AA0BX2~>HTX~FkJvqdVwAPO(kJzL1scCs-F-{4KWZBnMr zY^y5z1P7EBGG@}9!|@a#FMY{uL{3QXhv8A=xQIU4Pp2=Ci)m*Hbe(+fqoKrv31E)8d0XO%4?27F^jSQqG^)xNt9G zY?l2uRghL;qOO)LoFon@N~XeHZxv$jzYQbI@8b^Tdv*V=HXg-{*VA>_$cq@GY^-Gp zjosmxenlaXHGn9+Dc&DTH|y)s)K3mCt_FyCg@N<9RjV2qv>MW~op}P$A@H_3)Tjyw zPsyvdnofLmR~w=yto59wugG79v_p@r zYB1!5dXe?WmgZ&(w%8eazaV+SE{MxtJm%B8V6RaidxKs4q6w#@3DC(dpoVo&2$oJ^ zI+aSNdl)0ukpOF9YG+4ZG0KoDvB&1Mms)mtQ60=C7@PTaUWDWz3fN1%O&w5{9Qf!& zGT~WYr%-bc8Bl;_cW#BBnIW#Z71q!6#;et207%b}ZFvKmL`-^ry0n;IGsAqS1u4iS zt!2iwz=k42VF0As3r!**YzsUM`G8+K7?DW?e411NG;y(Sg|9>Hd5+%|sjwgSvhXwo znDegak|%4>egCYNcH2cnU1g?h=5L@xR|y_%BACi_G3~xy&M0Ewp!st)$O3t3T}Ljo z0aBHUi5Bhjaz(Wxl3&DZkwJ?lE78wFp|v&*(bUIFZbZoYWX_Li%fZiO__B zW~wPz^p&!_b~GJkt~V1T;%A)v_PP!irZ&OfG0}!{^Xa|@Aqz?qFG8gAmn9JSMQX1Q z6=Sos&gG@YA||HRTj8Ra{2PrvCAM%|F~M>d5jG+;0pxAZrVb|9ZMfvO(J~Ka$!a7^ zS0k-fgPbVl9~8cz%bYe@Cg_u`W(YhqhL4813ZQkZKh*`2WaxT z2;FTODq=H$klA^TW^Z{|i)a-0R|yH4;a{TJuxTrKI1R5r-(q?AS|}4 zjgZ(DAX@>73B<)5!x~{v{@1xaUwoOkX+ozj^6+4f_E|zOrwp|C%bwslIZK zPKoNl5WPui(MTtQ^~%<%b*;YYq!O2Y+IVUu4EW*G!LHS*)3^9q6qwawTFpqAOd9 z)!Rw2PlE*6KG>V-tq4gk*9KHKPuM;&{T@-iX1b|%)6?38{I(0CaYUbF+AZ2!n2FHG z8}%Ua)^t>?zOla=%!1AdA%sfo<($L9_T)=?629Ey70)5p`D6yttS-j$|CK2B>@uJf zZJFzi^IB*Ik}XsEz}0e`we2wLxFrs3leC&Kt=`VCy0Z}P!Jufx*IxIMYke5=pL~G# zlYKG{IzzG5FxIjSl*{i-sNbCh11ZEe9XHYrW*cR69y3)oPx;mEGVYF9>sm3^t4mZ& zZ?)3=wyB~%0gZ2-P;eH2@QHl4K}$9wWj0*%5>$8XI}BiK&J7}EMKgl~ffcA>bS&!9 zm6+U;p|YEQy`k}M>5jpIC_5{%o$(6HfnDjKU>iFcV$+M=$Grtw5UG1!)4l1DYF#T3 zQAERZ&RF&YhR_`6SiLWuqv#Y(f+P#h4f5~}!|s$?RThq_d6DaD=|g=ri!qR+sesmM zHQP2OX7bE*17&o!3PpANG7&S#ep6T2!_8s9pstvy`|Ki^E_WcLppHZWRACV_jWzK3Q=LY+#5!hy)EsJqaBq}8mb3x0Sz3X7HtkHLSRoRvV)aGQ&rqUW ztYmYs^uo4|!~%WEUMf7v2hvGu6C48v6^B3pK)`|^HptdhFk9vfd?EsjasY|g<!2M8fAJOn()-rNB6|1j7dKzM{CQ7*|4ouE z;`b=&<1Z41dHbPWrPf4|;x=J~`g2FWc1J(G_?Le{|NZsGJ7g;0uO9Nn{#<@?;-A;o_34#=(!b^!eSP8IG!}mF+TYaI z|MGY~K0bcm#zWR*)z%mO%e}ka_>6yf$sHGe>+p%^j@>h%qF3kdSo5Q&Z_w8j`;R|< z|3m*tU*EOx`fvT+)8DMGkB1LWe*E^|Vn)57m2(pcVl8hl-0Z` zRn!jMdHbP0b3Amr{(TQg0VI^y_LTbGiF=FqPO8*C>8kF2u98&k;m^2;Zoge1iSMZD zY&=BowL^G_vh3ajH5J2IY3WNqY7oK#-)ag!V^{+-11l#Z6B(^!ZsDU~@X8b&>ok_W zU^VjFRis3pUNt;+QWmmQpW7x0+vB7yD@DMVx5r%;D}D?pe4C6$b_yx3J7pF+6;etV*dqFPjYSd7N!-y~}t*Yg~kgQNjE3 z+04kyLXV83JX>Yoq{GmKSs$~DSQbxg3KbX{YLZfmRs{Bb*~W_0EMzk9xb+6xOZMHg zytFu(8vJ3a$VCzBqs-+djwg2xlBLPP$|2NGhMDEGy`EH^*l(BtS_ygRn0<_)7=zg` z%a0`G!L>GnTt8YB=1Ct&1dQaAUzNpxKzId}(SlNgZNq;V^QX5HgN0Fr)j2__GN@aAdr3#&zcM|-AL^cg{!-wu`fSa2$(F6#&H=nH{1wG z`n`9)<%@s(sc+vI6Dp$)%C?_ugEmu1!UG@z+$EqwBB>LZ$qA&fEOc$* zT9Ig5CQ)=Kh+eTj*zn2iB3*ar?V<9M9eewsLsZIg!#IEpc=IpU*67+9*`?MeS9r{k z{6oZa$nE3jgB6TLS{(*~O;V$18tNS-Bf`qT7U7F5?Pk2HB316}J+kVz} z?EMl78TzGM(J3E^m1ajE0#SiCs*HVz7d#-NyH%54#rCP1i!EN)yj+YEFN{UGSWnz< z6wkt4kZ9SC*(#?`x%$LDq1e2b+}C$x>-kbrv}613zykKRudZ3~tHo~~JCy%k?T+Ca zgI6dv!Qe=Up58kA78oX#hvamXc zC~4~>t|puEm&#tDQWzzoEjqp}r#ohXNu5-7{ez!K*BmBi*8LdVz%e$`$H%}vGaocm zkcK7andAMW-F_0~=TvQPQjM0E@@)5d={Z#E`86sQ3I@fkYPv6pMF!-)Um1&*OZB<5 z9yu?xuOX!=M%%AtcA#wbCQz^kBZl%-y2C&$Hzyr9(&6|*CP z($xD1d-4=oR%8OW^?gLLk|70q+XV-MfWicjZ^?$yhWY7{-E-tocL*7vHV7`u4h>6A ztZ^Nwj^Y7fUU?Rgk9^T`b?^l2R1?;;#O8dyzC*q85H}fHQ!k}lc4y>+MugJ}Y3Zc1 z;w5Kd_54ez5=zHj+DiFcc&)ninc4j7%KaNY_r5s%_1og`{tLoie$5U&4ca(P-e@x{ ztH(39@la`bmY|rwi2mD`kOOWf77R_?=2uR5jU7_6v1`oowh8~3O^X~7tQ3Nv*Cl%3 z)Vg(_huct2Sp(5;SYLiJk&RCXRb=mNBx3_3Sr_RIC%yE)wz{VAeuJUPiQn_nO$0pZ zAiUi9^zJY%+M+=E1Fob}6(k@eyU^iN+JfN#N^1;9O!tVc#S_EqhmjIsOQUmU!OI5%QYZ9B< zKXQE&^jA~iQ<93F86GLRd$=3q=QObNblAf1y*I&($y}n1j75ny`eVr9f?Mjz9~w9h z!pV1$uS8C5cRSsTH zRBJND@;4Q*i`;HK9kucIxkd)thyn!8%*4*xO%8KaERCX~$&{+}pDYpVHa8 z5lQa*gZuuhwO3Cu<5>cg9Yuqpp6g;(&G_&ys+#P1jjjFEs-~GoRX%PRm%Xxxf#ZeO$Dj$%jRA%! z9wjnB_@tOfG1FZ=wv3zuh9aEg%G253f~ASliLEL$ghVAT;6_5)jpCE`AxLAB3#2BKR1~duWvfq_68jAR(xAR@0F` zKVf-!s7R2h#-9By)*yBv9f<&n^ddPN!O$4>5*h{D%0@+7`l(L(N@PuKb(?$pEyJSP zR_@Nx`T}Br%rF7orMB9Nom#ruoN-sWoE@9l$po1%4oYVnmM zvB~UgdVsPw@^UjtWr0P*E+#q6Yhiy_6K=W95&1*U4WED9ITc1{AK;RNfeg8ufr2F@p*%AQdv;EGo4#tLCCc;lfRA2 zW_M!wjyCsVXE^pRZiU5v*wUP5X*NJp6fIV?8R|;FTfYR?N!i>iZD9sv+vei7vHF5Y zgk;ku9xDDBQ|6_7Lo>T5^w6J=RWSY4MCif{-^@f9)(SJT;*tF%>*Xl1gZ~ z?Suv9G!~mNr8JWNU#5Mg`HR*Rb%`ssL`dJO^aFVC9AM;O{!?FkwpfrA(3BiJVO2Io zY*t`t!`Hs-9*kI^#1zibGe5wrJRk_ z2-Qd90&RuO4B2_yGEJHKIP z+Q9MrCk?|)-Qvv2&XDguQZ$~Qj7;Z5rbzrj`rCD+pUx|uWABZ63~>jeb`{*yL)6H8 zZ5shaPCWA)VN=ve_D)Mt8r#pALrKiy7;c%@Iy3s(5h7nWCcCF+bC!n5B)BC4Vcmk% zC=cVxevrf?WjI~t@mx$eM)y$Z{LzM;WkP`K3UGS08=I>TPnp|vQ60`Y{Z#CE6Csur z%M?8K;|55KVSB`qz9S=n`|bSR#3IcYEV~`>BKIIj*{g5sJRM*Ym~ki|aj_&wv4$#& z(WLk|bhj8+2~9^Ls0~lLA;wsQn%#&)pq!*z)+YZ^1ASdWj{1J2262_Sm-EZ{*APKR zROm8k^fndELUS~oEq`;0!lpk_F~+db=;2dpb3e(+5e7*mEbN0x?Kf%G!~>bu zo_{T6bV#$tM?0jUCzo=oHhd_wcI}kHP81;JD4f2YNl=D~z(IH5K4e;Wny+J2tz8B332h3w zIaU|%)UgDC(srSkQ1-X2cw(rtcU@WMYEs&BWxZRBJ_%)=QlK!(I;jrXrgXrUPBNuG z{9rvN`)E>V=wMn$UoxrcJc7FZtE#&CSB-yNRcG?8q4;1V))aOjH0OxJIkPZfs^`6N*0yfJ3<_L`L;X6$er82K zD9YL#!f1A(PMRad%;eWYwRKAag$uQ;Fgs(^5U-+fZGY@_eR7=7ShxVYO9EA0qP}=J z-@u1(PBAgtA5%WOetnK}141)?@Rj%2oG^q?p06Xb#TXKbSV7&C7$2mCA28DTV5Fv9 zoiIaVpepFlsH6@h`y6q5zv1T7rp2-EV~q*n(AlC!-Zw zU+a^i%b1Zm%C9d*06N=^y1sYnT+V>^Y$uf18It+5g!WY>^GPcf!@6uUJVcZgTkViS zGrVR?|121f4X{~EY*FT^w!pBGAQ!Yg{%&Ej7iUch9Nhb=+s2S`Y`~@;Yu$JZw!UTy zFrRoicO*h-ZTvXu^6M3^;A4|;!~}54AvYGytwJdKZsV`xcJ5`y-Nfp(RJ0A@A}z8_ z_7bfIH>5*ki~ws19jb=vOH3z)3r#|aTE3v0*WChgPu&jrIyEqgfcQZKlG=%wMJhsu zjK8xl{a#O{IYQb8?~&oS-LZVpuU~>N$hE{QHO3BO7%mpgSe(8XVyX6tp=j}|VX|vr z2r#l7_9K2q!36NuXbMJJ@}5$!1X5;G5ge8@ndX0#00pswMC`!GO*s{{iF^dtBvGw2 zKh^AO(H0NCoLDQ2>{vW8%?jwU^u{gm(uzWKP;T>|Hr$}7!9!Ohp^~z|xE2zE=E!!D ztgLTcrlZr!fEbym=ort^Yps0>d-F%O>>ww|Cxti#5EU?3K?6qFVjnwYY4+f{pF;O1 z@Eatdy-`D?MF8r04qE3lV2$9YVS$LvS;k%to0TwbCo-!+t9z|OwWJb+kpal#OKh}g z>M830d!=njZGz7u*z47R;fz>O1@1N4IVdJBb(`IF@Je1)M3CW282#{NQOn+7mnz{8 zA;kvff_d{pjqNw%7(9T5s%#Oq8`x!ve`3Pg0XLahh0TTq0IaJYF(VM{TnlD&^RmfV zXw*=y$$m*<0u*tMVS!xYEr}>L99#3Grouwi`YvtHECF274pbI|h~*sMmzA}dXmb@v z>?Xu!*%fXCDGeVfGXNiKp;ZuQLnIJsWYMY}q1Ae6{vfkROQNJ1KNwp|Z{`t{C*iM? zq)i+xu$1jrgGo6vOc6E#E5B?Tmp23`n)XAX3u*&KNfwrmCdO?*QP022IaaFbu$DR0 z2M=kH*3hw7+y>)CnA4#Q^}^mJRe+2&nuUU#WZRl=uBjjzWsw+EJ=_)VK$28Q0o(Dj z%QPt>(Q4uTWx^|DT`@zXyyFj<)GsVD!L-&J9dw)S)|RJfO4`P>C=TY&P?3RIN=DI9 zd;A<_@loQtJNVu?QjC==FAOeMTVsQ-YtlfYoV1MP-z6C)Vq_!xofsb`7OPaFZ8LQ+ zsaz@>E-G$AYt*zgYAZpEWn$LS;A4@rUrNi4Jy^!JL zcoI>R6~ch46~b1Ug`;1o2{zih5f5#7`8_W%MVbe}k^1Nu{{~l(4OF>3Gca5gbWvhO zfAmPdm_OX_0tVoQHI=$jK@5XJQES3Mw&e@zYy&p;cxDp^q0*j*p_reWXGK`dwC}; z*CtuX>FbV&D@7d8IM)X6Y4V;VWMN{6l7>6!QP;qnTd>IX#o>nCB-Vh!;gp`Xg3a!DNGmE0(uY7=*MN* zjEz2mOHa@eJEHrU{t7VJcq~s=2n&|;k3A>dw+fykI=O>VYl?G>FRmC!UDORoFvSX3 zwK$o>o@&BFHo3@~Sio9ZAUzZ$9vrr@Mu3sUV}GlQ*u;mT0tlr|OG|8qt);8nXHrLs zqF4^wfkF4gdCGo!#-J_a&!AlH0(V8TvOUJCq3Ou83|{Kndlon)XHJ#YRrA0Ym_##+ znHhTJn@xXF?`8L8zvVETCTdz`U8~8QN<&dvjA5)*k2bxUrZ)~*am=vA5ybPyC5a1{ zSwxH*J}obJHt%VDVorq`>@WyuGG$bRHnFql5@{LXu(B{k2Zo^p6}3={bZi^MGJ`Sb zTivDY$REVXw)L6LDHo) zhl{F0yC4)=z66Cz+=(*u9EZqho4W}iktJ|Qdk|(ScCjWzb#8(6{H-5O;x-3!LPN(D zfr9cw$dJa&)9~%5yp+AgbrgI*anLR9bx|hHO7IA#2xY(w6LiIfJb&y`DI1SaR%UhO zu)+DlAk8BI!_kVlnW<`!3Q4$kpVae)EQs};;m41Ij$&e|xyjP-Pu@2L@?AUW6Qd-B z9w&rBrE1W3*{qTGgb~JUF>i>mLE7a)79){ljFxUIN>G!ioQb6~`GRSFyb~Xg1cDJw zU@-cwQVB(*vq^m;RHK#sejGO~P>XbTbk7vTnoVCYnu3*0se%(=D46=9iZ50OV@%fw zG2_7w1*Fm$?RmKzyu4S1K9#?j0{aqiK)*#P4OOX7wJA3yFPR5Qygq$XFaaUn=VPTs z;^JK}O$T(iQ+|H_r_tO_59W#tg@S^R_Gv``tBm|1-GP%=l~S){#Ze=w%;s#NEn?4% z3(waz2p^_MvPP;|Q_b3v?zYNeE7vS~C?)`-2SR=pn+lOCL{z|vJQ$%SisZu90@-%5 z-G#l`mscyH2N^@Kt{P^`g@CzLDc2GJDPcab*U7#?iqe8t&WsEZk{ zkHiQNXZg;|$q_;M?zZk4CSd+;37#xRlm1PfEV%JrBbk2`BR&T#H>0~Gn|C6|AiSck zUnav@U1f;Qurl}9Ib5BVqMdf=?7~nQ=I=SV1_q5XX?sF&TZMrVk%?Ht{PCEQjDA!1 z>=ARP#F_)1`$!uFxeKQiN^@9=%#lA@ldoc}9bmBu&8VxI9a~}gzBBs72APVs{F3fj z)!Y=6q#CGMJ_yM$yum z%a#R_UCQB{vK7UeXo-dIt`TbA(6Hg1lK|d{{>d9T!uAr0f`Z`p5^6F#PhTWs0+#ED zw|!-e0m)^aYfWNcS53-SO&bjrAEOzIH$s4AFM=$1hb`I5qJ=bMHQogxf)_Hog8-Wi<)sMrS)8%DD5gJ*<~5KQ_=9=>us$|2|BtN!HS!4p6W z{nT+Sp{x!?5j(r7pUE_)V_OKHMr+{*MJ62xzFd-6dhm#qTEMG>HBk-d-?|y9I{MlM z5fpLM+$3w37GluinD$nFbCZ>bXGT#0P30B429gZq(qbH6fJy$NTf0q`A4|t&9Fnbu zqy!U$H5Q|@<$&yP6B?PY15+6H)RkmMHfE6>&|37ytnom68%MAN_ApQ0vw5wH@h+Zf zuVA`0sxu@_Ms?sr#u4jGrD}h`5iL8Dtu_fa{!Na!2nAW~k|VZQam* zXvw}V>~)6DGiah*uv&-GHKs$5sAsvW~398WXHG{(O+6C?Fa(-c*$wY7Tqop zyoOy$mY_?QCalYf@VIa$I!8i+lB-J=qDxU91*1JV>LX_@0D)RTvWRt);R&!Ki^{M_ z8ylSEqQ&@e1}D;tnRn|o4|$3Bz78Q=!cjjRtwl)^GdUUe6h7D1oh!heNSIVb$=F0a&k3><3IG?GSRoGZpGvq4m< zCP0fWvLy}0Wa~>YjZRwl024=L=0QS=Qv_lMLN#Y53e<-)r4N}GDu~eQQlOX`UUkk& z5ysgr;7S^cItS3%I}+)a()_~l4|!mix&C*BqrY!~J0KsRj7?3)hovo&X#5SM`DN}g zOP(TuDcubbGFu4%XCkK1DvS|j_1d0<`X)Ict&HRw>Gl#II0abLjuB)d-M#@*0Hs>^ zx^j8Y8zO?m_9*}e8$EkInibYclazXA^I=z=!(H>KY$#d2 zznT3;BBfW>SrqKYPd0VNAqoq}#8ofV9!WG4%MBO>!d~(($7YeI23~tn85pWZ_+#9W z(yp*cn(F~PDthutsGS8DgcShxCp8u(fi5v#3d+_LSyPIYrrAMSVH=k`_9d1o`f%^2 zNzu+Z@(vq-%Y?&GSb3(F<5OCuyL_FXqS06F@?=p{A#eo6X(9Ck0&qLY zf5@(}xiT`STX@S4+2G;kA6oo!I0$ZszuJg7Vof;8cYggHanD-%h;So&K>8#_QS!j@ z3laA%tpcc*?F;8<980obb28#)FfAqY}s=LqfBKE*8w!Sa{)R*A0rf3+IO<} zyYnm6$Q25uIIvjT)=$d^oA^i#@^6o|Et4s= zxfV`f=t9t@_L{xm74{XW6AzJuB8g=vtcUfRb&(eYHEh&HyL?N+Mdh=Uvb{|ddNILr z!hG3rX(qvjrB2y|>X)yz@OF+TJtlv*ELnd@3D|^rg%t|$7*S||Vm*a{8zEdU5g#`_ zAQ;;40akNcS2CD}i5rbUMh#Y6suj%53OVUi-&Hk5LRb&hU7yBfQp44NfytcCTmxrU z8|uzARb$(W1ilWqviDPm*u{OD6u7cJ*&^AGeB0(pju(!?oK0q%C7DoVy9Q|1@H4z(rNi)ha-#sMh<*e$tFkq6Q&r zD*U4Q!}E2sqgmW;w`=XQ&u+JcGBqW98BLRxC#kZ9z=>Wk_C~&3W&j2O1nd#FfnhPj zuBrVznPb8aa0-of1HZ%;`MMt3K(O^^j9@C6iJ{}q&W7Dcz=PJnvqV@XjL8qAvR>gS zdpm-Fkh&Gl)2dWmQ&^4g*qdS7c`dI)4U@HHIS!9;M{b=&DKuyuZ-gv`)DAIr1EK_f zn*)eYB4GqS3$&s%Ua56ww%P|Qp3fHC$nQ+MPhl`TStU4(iCQrHVkVrMf0Gk^D@UGU zW;`6t#2lX=X{Wtd{h}6NW6=jA?rrKS6{@#iV0lmr>@tJbZ++k4^%M;u&)bn z=HZLw)XDS9Sq%gP5R|+=7C5Aqxgj(PkNx=o=oRP+Qq4p;x9Dm*9Q5#eZK813OL%;# z+v+$e!Hh3Zk(y2IEPVZ6GC~Vo^2Epngw>0H5OHNsRcZ){af5sXUw!(@aVURwbQ!mY zl>c?g|D;mZ!netqBaz~7Sv$11D2!un(9camGK46k0}N%}msT$=! zB~)7(P%8L>G6JyEF^U7q%}gA0)8a! zQIE=ZT4<*7duU9?A01icM!xe4zAzN8g-5~C4Vy85RAVi8xIr4Qq0XRy&KJs6pr&Ot zlYFIOvXkizo2RXJhKLcH$c9YM#;-0QWRvl}1I#0RnXUhNDchvdQKh!FSv|ZEDMUMh z4xT50#3$qJlIe1mH#RF7gvx!m~m4;eI_(7nZBIrgcWrl*-X-M zCc1OD0-vTuE{YOT2*^-AQ3OV7qZjEJU?>M%z|avAneoVo62mf@WKX6fQHM{#Ter{* z&Wwxs$uA}-zRop`4!_O|l9w5RhOb4N`>P#3TF$=Sz|^QAgHiaZU$a0f>*O5&Yy?-x z|3%595p@Yg_dgo&%gn+Q&KLcnYD`s(J#^SHSc#P3MVX)H00kokRnV_gZ-f3hFHn*R zNvP1)=9hN}9(#v1b*Rl@Z76f~nd(}@TJ^FovT)PVg$$iOU_E@SlNe-mnS;Jqr!aZ} zwFJFEK~m3UlKi7^$B!J1VZGKGyeoej{<1^{LFRH^IVC$9OOsoG&yS&~M3KB8c`rj% zKNl;tz-|1{g51idRs^uHBriw~=#%#geCqu?pL&0Tzs9Gpw{P^9JN(^i{oPgm?$!S8 zRsL=}zu3`WIs$4jKAGQQlbQ355xg5Dmqx7OgU&SM1qeI@hDNxKV^d+R3Pz3 zRY97H7enx9grgsMGgiKEA1V(!Dhq4i1+;mqQtt7Itb|604u+7DPJz;EWVqmdXIB}J zI+5~B!bScf270nLNwH?3b4B(=;r5D*ZeC^~+A=4=5Wk;n>vEPvYTwZhB<2Zjhq2ud zleV4Uh~_Mf9V!u450Yr*zlNPIk>7NmRB7fQu|35Q0JbFI@0lJd8tN4ru%;kC^9huG zF?YQ&;?n5k?Wh4J$W`^O%MIHoA9pR48za|mZWzYt7h2&b!liex%I082j=aolfzTQ0 zP&yLULlhKC!e&fQCN)AMN&i7h!%|qsc%p&`b2>@WB0Z!>Bxu;ynDUiVMn^d-hbLpz zguyYWfwl&PHNICl4s2&|V1O+l$g0qOUcNUrai4D>sNCaxJ1}_mMu26Hc2%Wb%?7k5 zSLsPsIEA4%&B6 z&rg@n&>h0%^Ik)jHe&0=gailhiZ(bDDjji#DB6H=Hli_kh^Q6Ch+d;aO(cr)zQ48h zIsc)m1@B8<^P&F#|2cbHd+jyvwW+~PW{G$-7uS+~TNK2FwIS(^9UiD+kpEhUbW?ft zlf7~EV{Fv#$*TvxZ#HT=f-e)7fT-M&%}Du8XKhal-+lbQIjCsjydh{s#a%+m72x8Y z7dNyI@C7pu*w_qTj6^CH&tU+V)z}*SK`7G4IsqBb(OylzjCsz=d}}-p)%pyz0QG30 zsJqH40|aV63Y~*p!Y`Ul$_|APxE3-7Qi{C$hXx6_=%rdy;W$HNTg!6X&2e!?2f&dx zaStG9D)gUvCTMEhLCEBJ#8qmD+^C}Z!TvxX&?gu@kHuj<-UH34l#NAeoF;4=|IbV@ zP_-j#P0_FeT8i|)8EGC%O-K*q$_GrzGN^eVu#q$K5#V?wouLw?g*Ww68Kv-op)QFm z34v5eEX*I(athcdalc101C~gm?U|#z5%?jg5_n|yc?bth$=l^}KR%HB6e$zbhdU1n z{}LpD2|}TDO;e`LIUs)-A+Cpd&^E!wAj4J>4I3J~CI1w#ja*`dw2R&(Qwid!V%7Kt zbMv5I+17|65Rt{!#K+Xu-YUk%si`ZW%NivlYe4njG}Zjn!3qD;)GpeyKl&a=ZTa_= zoe{@^Vo32pf{bJ=QvE`&V8gt~j zwjn4?1}JFyB|i*9>_>ETbS&#|d?d=pN`kNB)|_M!Wr2qL8YZ5s13gG^n~nEUm#x#< zI@As8)Ajt)jux=>(RkfyR4G{qGq??et_tWE zl-43fH#Y;?Zpj5AIvM*D9~NamjT*|W{SQq@#c)C=J5B28qItl3thiSI0%S&m!xIrygaN^f!9fJv6_z*X?e>*oMTYPY5)MUXZv2>LQGW+sjLMc-4cIypo3(+o8k}GV_ zLJNEapf925#rEQgREdGHDv|@Or`RZFObtqOIMfshy(?BBgiI?Wp?02~8KL&;W}E*r zhi68nQeE6kkZ`iUT@+YkAQkt0$bLb8BIrD<`D8h#D}irLa1wQn+@L9|;Y^~Eu#|9{ zgUWq7v_KfCDFNWMpI{qpCCH{{(699nrW7+Nn0E2{M3Ug>8}_;07YRZGCJCE*x+#oHsSwgUjgcXcuz zV7^427mc1Jfw&2xjKSVWjv3)Pu#>Ayy|f3Tmd@AtwFVNhr)TGl^yF(mVqiboMs} zVPV<%;~p>tNkKr?0?3`l`79fnV=M2}7)YkkmQ3-2_g<6ciEiud}0aUhSifyYpd~1)(+VmE4%0<8r9Zt9m zVF1f}6VPWvg%_0FdB!za{2+C@Acv1cvKg@&FQ!Grzn{FpbN77o(bacCmN`To1PU`eI?-C6yuhfPs(}mq zbbHUfXd7#tpR}D}ir`-CsRNxQb5|~4Bt%|22B&==TR&tF z3zTgcbsud8SrC|n#djm&zx5vr$c+k5#2+?*WSf@b3nC7%k{7J&G&ps10H2+rTDDwkf;o8I&&?wsMGyy?Y} z)M341lQM@*Tv|@=SOj_@byy4#EzjNQz1VWQv0}mttnrHqzY*S9Cp`t^=qRt{L{rWd zBDfo@PgSD(MN*z77#g(E^$nB-YLc^E)$dep;YH<-_t>lHBy73;ypl$`V5j3ZENxwR36n51Lw8=KMk2I5l!Kb=yY*U+RI+b zcaQ}ii1eDnbdaX4PNe*FZloxQKS2b|+kV`G>@V#L+lX-*hNR4Ln%QX9Hw6hWGoZF9 zF8<45Wp}TgWgc6E6p3lc3DYCYOYda9UnhA;9WpIeC;T9d9X~etoAVAU$2P^6SiGL- zng9{zris&_t;ae(KwI7hv{iFSwKT1yc%a7C=0Junse@lu|2S>aAjdV%=Yoi>%Uzq^UONeTKGO)Bx8Gtk92^k97zOd~f6e^*VY>;*SmdlWb-YSPAZ$&Y5SpdtK z3hZsInZhu|VOS^f+UZ=6^4dk@wTmpTU9{JVe_4^aNwGTtmSfDj!~deU$n3?BG4F~h zSnCPJlcsg7byW;J*thdEzV1TOk8nj}G=HNNW3>q}@K)7g!v8Hvr>R8v*q4$!V-SrP zezk^vAky@!>|y;*sinDyZnq7poYlECK#={{I$ZHCAgm%u6Z_B5*R>&;(;`~6oW1U_ z(OwV-Exrvtu{-+6N0K=eRrO5ygN+zUaRUy%wTA^9n51v*mbP{~Oo)Vo+!k7xCE45R z_jc)UZweK$!PZ1bwr}kov^9ti;5Ct6lS69c7Fl^9N^%3w8^yx$ZFw3+et=DE1D9Bo z7N2olu>{#cX7f;gghgx_fyv(-I|9O*pe+I#U15*}xs|^K@!j%8sM(}=6rzy0f&jtJ zMTl334;EVa$5=dYSAVc?QoL3DoIYIQj**%SM);ZJ=f{Uv*?B zhH)!F{6PKW2)lcW1`;-qFfq#KSUBs^S|~o*Zi0sDenWS%g{s0Y;}C;c1JXcL_ENHs zGYb|0P^+=oo~35u+uVjTyNcx{Xvc2cHRndz@5RtPUuyBGAc-&7tq&q{AYj54$RuE>gp82sz3R z#E0SAm2_%QmyC7`!Z9X948_&@ z{sp_F6T&NI#y2quW|WqbX8}0^TOeX5&_wU_&kmn}T_P;^P@zbN*=L(#e1r2bROH|(JT+>BeMDPrOOwuInH6v8^hk00EGv{3t3~qbi)A00w#U_j-v)n+L#(eE8T4p) zwVMhhAqp(T4t0d!rd)_%da6&4V*^M3JQkc8fU~2C{GF{NyR>HMc7>hT#X5mRjw7I| zi!xh)#7F5Ny|69kCjlIDEQ>ZLj2A*${2}@XU08U99w*=kzZF>o;Xjf@Xq!0P9_Qde z3?49S()d1`l_dz-M03Qmt;(i$!8Stq*Kn$xjZ=J%*bkke1%pYK@=_fb90w0D zw5V@mJ?w%t#Es|T5e5udd@VV8F3qL9+@~VkgO%?vIfzB!^3npkfC(fXeXRu$6d5W~ zx0)rKh+(YRYR+YiVV$Om46?V^+Cgh4yt0gUT{5Ffld=@-U{P8^S$6iKO@iP=wz%&0 zW3>5R8_AVBFVhwiq>)$=;edw*C+UB+^L5RuQ@lRbR*eOjt+wi7d8y#awqg6PiXy-X z=Bc)zYVL0^<9rzz0Zv?84~4TihfR+cUN3w#=jeg2OqsoBGywz(Ac*ovya_U*1h@Pp zieQZ1_-4|*hG1YH_kDu`+O=Gm=%T~Z6cq{wZI_SVhEuFIxGZsmxk1%-eoYc{;}1Yh zv~Jq#7wlrk=!@`=f$D2{wl+}ptFJ}H^H@1aMb-7MjO~ZGuOVPvJ#=%HZ%pmo1cWir z$IT!J%idWjsD!xl>UtWd3AXlO)f-}NhUM~CmSFYi73}=N>VZEiwvoh4VY@~YPjsNL zHaXOtn$DVcbwN@i;O$w?H+Y$7LUE{kf;ZIq;y{Khe0OM)PXi9}WT zj?RU!-V&HWWQ{E?Ud8!o$x=zaC4#N6YsHCS1!9qQjqcfjq%TECaZqD}7;6m?-!<_4 zY{#?WGTJhB^~f946z$(ogXb=5@V_H12sj3yScVU#G?m7QBz0f3J1;#4^Ulci=cO*z z;8_B?kQxYRFpo0aG8~9#!D4H9e|(n_`GA|g!0(KSK~6RTexlQ%wf~X?4w@+x4{DF# zeGyAF5USHAR0pBk?nW_2tUV`Ph}^3Y0d**vGK`y0;1tf5NOA@t_X@+}ZLCDZF(0>i z2))xvp3d9Tf2^MxmPxvb^Oq`Gn(@U(ip;Fd%G>zT!SQ7pAJPcZVUr*zm{||G$j7H- z_?l@<+GAczMob_<0?@*TlIqS6Csn8TR+_H@RjT{>wRCGz9ik_v+8SvCN~U(%b;4ZP z04grNtMF|J;EWG6M6y+oHwwc-+9@o%wF=}j3E30vA~r|Z8vX4M9}^b> zb9{7E*vS&LiqT_UZfbQ{W=dfJlVnTYt}w>v6fNIrb>c%!Re~*x@ah($D0OYX&it)0 z?kT5!RE~?+gz!N255~Xhi;uUV^QQWt{zwQMp)2KC0YB%?+Rirr;^Q%A1Qe@@%<;qc zXw;{IeS^5wcZHL;Yvj-@ZQi7M)px}aibEte+V*{8jA_YshF~MT!zqR~7WQ+1E8@YF zXCgqs7JvjKEI!ZC93dgH_1zyb35W>S*v9EhPcH!9r>qPn)D;)Pj$t(i&Kn~(@pLP; zZev+HX8>Z9|78}NNfWhO)WvvhOJijKnYO`@Brn;k#l_(g#ML2~?Ub~I^wOFUlN7HR z5C#*3L8e5z-QuZ|P$DZaH^U5h6UzH_;uw||p?l9ZGZ)*}QW!?X`W3)WRh^!)s{-~8Pk9-?i+>UQ`!dDY`$9k>OMsI}(dYuzzWi)9f2L}?$s;%x&JEi4%5pHL>) zi8sZ&H^ok$i_7{W5=W-YKGt7_k`)UXqE$}|?JRFZ?~~$uHI)`5enRLpf!Ut&6C@pa z=fe9E7^R(Vrph=!*Hyn@iP7>wYKl)eX9KB&Nf~4-Tfjnpu$ur*8QmjnoyE&N#;T=} zxPbx_z^Br*wS&BX+6toC+)&sK7q~st`90zFiBb6XN7=^koeTFOZXA3ogat#|`9>q6 z>zac8+*#B^KSOt6|Gn&D)2+(gy$(3B@1ayeP-hV`iC)Lgvb~6K+B5+j`P_e(11vn* z^7QL9Fj$!KeE0~bcOl(=>tnyA=ud7t-&Vc(wl_YMa$Q|{`DGt(M!KiRP@8s^PPm>6 z#;)t%446@{eBtJUes;q3Y*ZaiJ@BHfAMPc4p!NpK>-G#(k2dakE5+E#WqiFHq^iV! zC%)yA7vDMd#yd{9{>1lO{AZ8)n{A)hWrx|%-*C+}*L;<)EQ*&q@$9F4bM?R6PPuQS zpL_iaPX3h2oqtvDwTGYjWqrNMu5bJfUv)hp%XVFvUZ*K!drpk5|Iy5sJns*B z&z?O_GyaF@nM)**E4tF$BgB#d(p+7ARZC1jz6IG_7vpeE8GGNDk3E6AP!4o)%ab`G zg5d)sW#^-HQ@|d9u_m@uHy{%I;8h&KjH;#Gt?Ed=z*b`vS}9{rwgc^1*r`>Is`uX= zi544iSc0F~mpOz?2_kSpv!(8Uit>**giEyo4Q&gY06iq=0l92Yu10ImP}tCe2KAw5qC3y6kvW8oU`su&W#Rbn{w6z>`3;}iM7t#}5dc;U0Od?w|Jycy}AbpeKBkS7>toy`bI~C)F(YxY94Utv@ zfk=i<{Z@-iRqKY50H^;mHU=Bt7q)ngM-je&4tkMvLUcD@PW2XVN~GPjEAxHfic*VR zYG;mC`r0&Gqd{yilN6|1A!HTkBa-A*b{}Xmgb_3|RH$A!DH(w!ioyy+#u}?@eW3;^ zEt9H#ab;Y+ju78>zAmn={cWY8_%Yimco$*C0h25ek`d4#92SSlUnIkbE@?!wm&i>L zgVm=t;0j@LiPVL-I9puLAz6a{Vq(?>ct4^pNZf9E*CJJ~{->ze6$hR-z}z*ic5#yY zHBt48Uq;$#_Gq|h)ooIc7_2J(yru0Ez}CwDG!@L^9ZrOoVT(bH zy;DOC_ATRsMnjVhwf41P7IPIVFoKo+PAay-zniYzXIE?jcJ{rl zFxSQK7jC6MuN6iG>`Q$QYvMr?x4H=2;?p$z*6=#C2G=3;b;t(S!8by^4y|Df(yaLB z>%jE=;@Ovl**lsJPCo1~p=dMbl`zwrwRR~9`U*Llfj`|4=%yN3tnkjf_;I?oUV{8` zhJdAq9WErV&Fj?QnGvO0w=u|HxziUsL-0noi%a%Qad5TD%@_iC^(oGww%LN*8V#pN zs)ISetQ(Y&a)l^3eN3aPKFT2}6q>N!`9~fRDAa@P&w+)^Mi!EdWMopGwvc^zEZXCiiMofU{EYN`lgc4{fukAZ^JwBMzr4=xo!s`RH{OS2GQZ9K9=WY=>2 zEIqf`x6~?XO2)={(Mb($f{@9whKw%Y@=t{BNhv4FV5>UBiIJ8@e3Hdgxb^>|)}!s~ z(cWuo7+@9HPrbE%&5B6pX!+*CRCjJvT+<4yt-Hezd|CwDaeaDM5Z$1m@h!K8a&;$O z#t45jX!tsJZT>G4NynX2TI~+2ja!FKi(`A3loiB5G>Jq7gd6;RWoOeK7Qc|mo3&P` zo0gmqe!f42LORb^e5Eb9VWt0=P`V8zA;F?pO5CvX)j3y`mATZ$sjzdAET-J*Ra^yP zfmC=8arE#}_RwtEf~=cbQ|<~}2AeUsB(z-%llY7xVxZn?R{sgUr^WYLO7Kh@T7MA}(w$f^@PhJe#SZF@t z!ZFdR`tcUZ*zb-PJ4e5djyPpNo%8G!qFGjb3AkRsyY%?zrF?WN%htI*`2)>t^tEA6 zp{QkiJqlI^D&lyv$y1O#F%KR|n|#dbe2OHxePS4Vewt4WM?_E3TKeQz!78jfa|Coa%QSy_E*_a{l_30v*Cf@A-}HoRpZN=a_PW7m2+At=+JR>{LbRlYCUO8VoWnJo zFidsim}27-I>_#s9vwwEoqiQ>(+Gt-K5`|EV(;KadNAI`ZHNALy!tuktnFPk`1IfE zr``Ig$|xwdYzqJ+VXLOLktzLt8uO+A1uO4B2*g<+V7#0Ue=Q!Pli2JEO59eCZ5J9= z$??%k_<%IMK*vcTLZ|S7H+!?<%R9yYz{_T{{U}B5Crr6G2*lzVT`A%*t=Y@NIT!%_ z$c~O)N(eIh6h(s5nX}4=bfTnpoM@~L9ep_}{z#m-C@tMsuzzImFQF}7R(ub@l70$44qRq9D@Yc&XLTL75BCvvXJmWBP1SsD>=0x zJ%vJJ#jTkpM+0_Gu3-s}-K(+XvY9DSUOT&>>kr6&jyw66Ee3!k{Ri{*2v>&CHT(v%VfCMevWUhBU?AAjM$yc6&Td1>|f6Jn^l3f3o`_+oy=6h6q>DcPf z3Q$tw2;LXBGL@giRjJoQb+7ii`+gR4sMG8Is#lpulA2d1#gEcz>4CVKDt_DM6#(Lc zC$RQD4Q}1~f^==I4x`h3j#$0{UNQ!HPzPGmWw<+)?mf@nT!+${0 z;`u9>DI_s57L0Frjw6$(En}OEF0$1&n|2PH#$jGo5l5Zki+G?j)i$gD-*SMK>PJU$ z^-2F)r4_4ibd*$|i%#Z>Yk6BSm)wCLP6=w_(Dn@xXX``Ow4amW z8Nl`}UqxCf9vw}_kJDntN;#sCq-ZzeDk%LpP?{gtb9s5mc%rPNisBiuWdd=L7 zFC8wOP;V@J`f=VeF0s~~QrwXAChWx{X@RK)WD&WmeRsw2D@BftAxKyMs&%{F@;;FM z!oEY|MZ&6U*c4;c4<18Q!1C$TIqzU>=JdBkxwK19E>B~@i zSjCgy5BLH$j8lVC7FyH6w4#~02MnQHj;Lv68^d-$JV#pS4y| zQM!J-MZ}42yBsf97uTnYb!>|bFlAuFun}-UT(AZC&4aZ#eM8Jmk9%m&vH?$Pa}Xm% zxz^%LvMI(0M+tRLNKHAuDgM2+JM6|4w2iYEzT%v1b4w0w6|aavpz*;4QKtfhg2cwX zQwmz34|<6AjS+n4y;Qf_nA@yM^L9XNv z6VZ=ib>kPZWp+Dt(*#B6l7OrHZ?mNBwrW_NET9`#2DN2nsaLP2j$KMOkoM8^C)tN| zn1{oOHR@AB;1uZSD2V#C9WVmT0L>htK}(UgW!;O)!*w>`yTxy)eGAmYN+sJv|LWxm zlksIvv=0Z@OmraPNsC37RbKninZZhy9Qw58ep6G9Ba<(*uo%+*xZ;)ZGGeTuApW8E z3l(EOc7SrFh*rE*=A`nl!w|gTFsOm${WLfjXenD5U^fVvS_P^=ZT>4WsF6L0D;U8Q$b<^vNGF10PRneu&t*?? zgLfNN#j(P`mSHD5Fg7WUh!L%X^Ul6~rl37%ctLzf^!3k z9xnTO#b%~$taCF6A9U7G!~^VcA0-=_wknjbrOP7xUK2hKt|2<7?4RXf#YtR(V2t80 zgjO&08#H^cP;m|7MJ<5#Nonukkue&c9}Lp1@Z#WR+n}ad-Y?%216u_dDulidGt1;8 zh|f-vlEyM<)uLeFgE7|yItyOG%pr4yF^T5_iK$|>EX%^rSH}CVGgWUH`{>B|H>u_mK%Hb%Jw77Mp^+YkY8(6?aoFG60?voum`%o5*RVYrSO*U*S}-YGjp?mi|{P_+6yKz zEKi!Q%W;#Qf-h{Nkb4~>r@161?;y7OdH&8eG7`#$hzG;m6jvCeG1e;6Uh%(VA+%I@ z;I-<{Q1M0*Z+R#xg4g=Z1HgeK9@A6kcKvg&{DaKuU`S z%Ix|?J3qXLQ=2{}IH4;DE!46}dP_3k98xS9=hU7k`pU~RKcn)Hz@43V_sOwoU%urj zB&qxmc8)2Qa%9+kl+$3zxZDKkWrTJl-9uz?nzXI7NeB%;xq)yB^c zsdmQ>w4O@==vGY^lLBJbMiiH8ftq}z)4N>L?Uv4SL(HtguLkF>*=^m+-m!yITyE&N zp!s=6UT^gxj#POM20%vDgsQ8(Dj9;Y_-#n#+SAUP+mLQy_^WLAFl@fp+~o^tas14x zK0`lfuvg9a$mLKXD^FIkg)ZjfAf;lm&R)#N0oJET_ZEKDli!d&uj$?TEk4rHy|X|W z+1%;N5P~K*mQ%tx$vZ4MwmS3O7B3)LfLZK?z!n3-B(e4KxqEx!nF1r1?G zhU(-sxzP!SFc*_E9ZhB$TF(lT<$sVbJf-0aNbFFF;Nwnj7GD+g$W z>ty!R`PFgcR%;7pN;Zy2zM}Ll`1ewX5^`=@9aEekyR;;txccWBqMwlZ>o3ErM*H?x z#b(iRIHDPH%}C3S3Gqv_(}u}QFqgeHKa-&R8XzWPxP=BT7BtXZK`UbME!0$VbzQw| zPW$+8#hreSgooHIj5jgnB8YY_&O;*Xg|x_^j$EL4d=BQNI+e2;38Xoy>MLV3u6p$= zL8O7uS_wJj5HZk`!{u;o$V1tY#WLM%VRT`cTZ)9T?_t}`i8MyQ`pLcoS#it?hP0S9 zK%^+HXf+yQ0GR?9wQ>rh*AB6Bg#N($@dxl(UAqo&ypz5!9Xh~~H--ceO zRyFFvisF1LvGXH%6h_5yIV^JxP;32$mY9hs83I*fnrOrY5{@ zb93}6za@*uWjnwY)sZc#{%@pvhv85kw)YJSfK(Ws2Pc7*k)4=k&uTX#9H$1&>W6!E zRxk+h9a(@7@sO&ETS?QRGpvYU@@|J}WMz(KqSOY(6fHrgSi}t1x6HH{s$pY2Wc{|< z2vgCSy^uDH^34f4P|!}$u@!aELYl@Fu{OiJ*?HrHJ7;;`!sEd_U6?PC2K&PZ6eGohQA*8$ zBU3g5#zzUzPYWQok7z!R)U-b&oId5CmgQlQ9R?)VPtTFpsl7o9jn9r~#_ZP^GG!{M z5kwP;*d^EQQ#3H9oV8b5o$!zc)2dmY^2%#fL2bKBNn17ln{4;wP~SimiRx<4<)c0fn0zE%#0CQWLCu^u*g zrXS=nuQBY#V4$vkdf;tmKqds|1%ES}cO{9jbf)EKKWLxmA=uF7{F~rLj|WN`bBpPq zG*+KSs`n+*SQ}}~3)a$DbF6A*Ga_AzfrUf#K4ak&(=(pNivTEGPl#$VcXtEL0sg)qg(p=Rv!f}sYVr>sd*n*8G?TF#| zf6^>h7=z5cVFmrHh3;Sjvve{7$KomQ9i?hDliVbm*TUA z4{9982aq{dkl}WFV3R@2fjb*h|Ff6Tba6kkiSK_5yO_gODL7S5nH|A$77#|-BwIs+ zw;7^OiTXfB{kSqo9O*?%GNxUpq$(sy54+A2IM6Gb+D27ssE7BnMc12d`DZ!F{S8SJ zM{%c{X07%Z>{4`L(p{=b(=v%wY;s&TQ`id^zx)Nk4&>Ls_GA)r_i^!&Wwxpn0bWY$ zakgqqzd|7$@Zr&+dc;swAk>-GBf8cjD;1s}spobNsq$LcD^5JH1jJj@(j=LGPmJuJ zP88_-;E9511)^g^(Wk;w%IPLB-vZI62Tv4OAUXh6;B&X(k3`>r5rbW8{TX7nKMn?? zY4sk#U|{Hvd@v{^8VnYL8p1Y`0Gibh>d{@-mM+?5%OtuJmhfr(vtNrPEBCPGehCWKTHBjhLC(_h|}U9O9THgN5Re z#G>ApE%qfxWw=q8ZJ)9)+5EcGgX9m`gxHGv*_nE2jBs3Aa=hM>eKt#70M7tTzB8-J zs?|W>X8NTVC9ZZBcASb)j_obYO%YOZd)VSEA-Fn0C!k#?F>iWHT>L{D%!V)(&j2Pw z9i37GW>=_lmQE2k9LYp;687e%F>2@>_NX@)5=IP$_tdJ6LCov;>1ws32kqi->50m zMjN;IFoK%~Nun2ESGpqQ#;SBBW0h8)XqDo#jrTSwUbrk$h`BO4pM|vyI?8cwRDDA_ zCw!3O3l`yFLOF6DL&g}Y(PY69}3At z$D;$n(LN@Qm`KP42h+hE4vLYTTS@J)m#%B_`J8PR39%OEgT}A;U2Q8Z8F9u7u^Iy1 zl`Ct3*h3`{5^FRjr#=-^Hw%sDD;uS{mvB8#Y+!N|pw|iSb_jj#%D!rLJEEz zT#Hvr6}4eJLZE_6f+qBF2%1`<6`@(v65rY=i5ztBu^L$!h@E+y79KC#yE`|R0Ypd2TYc~wawukJ2MNqbqp{bWn<@b;)-Ld&>5YLfA&T16QoiY&Y9qvLqMR71b{mlG zSIbEGYZOMgDBwFfz*8HP`lUReo00BggICGQg*+mhLQhjeqpb+4_!to@v?V+8&~Vy7 zruY&VObP1Rk}^m@8g-Uw+EfoIAVaI9Z7Bt5s(6BvDru@lxJ0U|zy6Zp2RouGO^tQ7 zh<>u9HpEj$QC^m8n*lSDjcjJ-Z;p15MIbt#|FO(e91%iowTMwE7OdwLRkT8BJT zdK=7${BOQ6sQkQ@Of=LMQIB%ovt7!Nl0#iY#i9}D=D5Hkx2|rVus|ck`{aCxji6fy*8AKEE$N`N$ zK4u{iV*(VWlXN2mkTTI7>C&hJCZ+`#=iKJ!N!W> zsfyvVcZhK|7!8D&3kw}W2r_SWquA0c+aRp0g_&XIL~LKB9a#KR$bj0ajv|zTc-Z~| z2y9CE!N*ZE-N^(l(l!{_nccw_Jp5CJJj`iAv-)V*q`>p+-n0NC-aGA(pMsZ*pwcps zWjhna2CS|0CtF+$5kk=4@kGsB`sD;GHin+eL}h7$CG^FA+U2#xF-F&6=|EkDyYPoa zfwHkkk#b)})z9z*)1Z+&v|Gzcno6kANiueaZfQ_Ux(-YR3071$c43PFOoxoY850lNQRuEG7 z>1cSNR*tP~QXIl8R|N|*bxI4o+yE3b6-l|3Vjwoo!z;{M#!QnM3B66*LJ2sp|A-0~ zhR&TuDS0ve_}p-w-l7Y7vtKtwPm_pJcq_pp%Qe?Fp6KR z{Z|5hX~hlrjHT3j;|(U+8hg0mc2?c^LyMx!E2c-}P?GA&N@U-TlSRtDVL8&(9K0oK zY={yKZ9ymOmKJ$Jg1l(H)1^pez*c@*MB^f}wG$3lCpPZu}go6gWXb=n3+C&c=l@Jr{ z?I$>hZeE_?K=h1%9t(WFoXn12)@|*eRuDyotWUxe^ z5Ci|Twt1fasSh`-^>Dl3s+pSD@$_v8hdT4sOP|SYRskXRSza4Y-XOY58qzImi+7|J ziEjho_Jq36ls-4Tj5!tgAN{BFI_NClJLvH21mjr@iDmPhXu|_A5<6^^OA)4rpo`-L zNb)_ya0$VBZj+S-=KQYVb1$zkFliz>irj-4*62ZMY#Ya=K=TtX_bNt`_X;SUB z#8-^XMIoIiXV=8}o$X}I58BMxL7RG2#sH;3quZM_662tO<^5~COt@&y1YtPTf7I-H zo@#7M`#+25JG(h~Lu?B3cD$G~juI8$a-L|TDvM|3%dAtAQK~L44IPi06vBR(mWwf} zUb#U`+85JLjF?ozIdj%@YjF$eg*bD^N;K97>LSHW$;i)wOYCfO*NMd}m~jT7FRbTa zuJ@Q+@4i01J1+@)wI(K{iL%7*8o{Kz75ieAE0JRUSe@h}spH5n;E#YrL!pYZur&$| z|7^>prWS&|UO^4ZDFl=-Pm`^Yl8c*Ttcc8`)x5EG@O{z9nmmja^&-5NdBwj<$aBy? zOjsv-w3!~&(07AVawH>5edq^ldacXT6@|7?0{M+1J znixXH}@L^nn=Vy=&!(ub5 zAWnFd0St*47TAHrsVE2FqaWCo1rck_8_|X?7CAN;&qRLt76)a{5%jA^ke@jkzQjK(S01D?E-D^VR z%9-FhoUfd;O-~-Id1MlOazq1(~AB(DgE_HQi zh>*fupHGORe2UM<$5B8K`#BdiKUL~?If6gU0Oa(I`BQwMWqG+Zp)%HAJvr301%W4Z zC}rnLW;1FUrdggcZyq%gMwc;v{MY03i$DJBsEA+u@n1*l z7k}pSnp)k$J*~iwUn-7m|CUe4*Zyuw(uj?X&(llY!Z`Qj&{w@M?{-iS(0P1ucU5kpu$^ zi5A|ZX>plK67{LN74o9ZjECQRSd%Fh0isDh(KF>GzGa51$+;6;wq^Um3fY1M8T{kT z?3eC%(Mb&im!7UDvW4f3y zuQExvC^KnQmYw;F_ENNbhSDr5(GrE835m|D?mYXF1E6$gDVb@G(tCG9i;D{DSEs=r zpvG^X1}MA#|9pA}%}?cV6sK9clTVC|qr70CK~RxUJh^Eh-mz&RdCugNpu_5fr^z{Z z69{SnF%F->h~P5v}Fp)t`F`?~ImYlYMqI^1(6&3-h{9S_wZ((2?QV6a|CCr?0>R?%{UmCPSM z^uYYFv9pzjDT5S7{y~u?n%O=xmyaMl3|L8~b=x5*S=;x)&gmoF;57SCZ|Woejn0NZ zQ?HQNw>1R8E~kDUQZh0~Y?Z#$4?kAZ%m!B9+r}6S6{wYjQEoWW;qWX`;Taqah{sI) z5px(BTx<%aN3AJJP5%50x6(x=$pqO9a`J0E>)xju_5Cr=f#ylqGkK(r3Lujeh&R}Z z9t^cW4$Dz2)BBmYhA3n5K{M+zmV<9#&>}H%ev@yE&N*B)sX;K*Gi$MQM%eCB%Vhpg zg2~!^z=)Q+l#UV32I;`RA93rGqUXNW1k{J0}oQN*LUNMj# zGpzDU{YVdEd|(`bL@3=#h>a0Y`5F}vQ8#Tu7Q!Et@J#7CxTkFDU5I(Yz863tfwKEp zzR*r_2J}*#$9}?-gv)g(J?ASSqyP#&g!jdJK|S)JmuI0aXiE@r!0f^g8>+XK*#VKf zxU;2ey$TMb&{`sof;=W_SWzkJ*iWg*mmv}?ZAOj_2n}Od6$vDitTi!>)y}FQ2B8tV zKIlF;6?M;h)8q2q997(r2># z!%3=iQ%?q?WVIzHlT8-ryT0 z%db^zj%}1-n@XE;H|u4=IY6`yD-#0DGMubNyO>Nl~8QH@s&WFsGtUTy;AU3nmNUwWQnVrfTR1k2vetpsD zUiff5I-HjsP8JgnaiJ@nNNVE{zwt8nKn^go9ADhJxA?EiOmLtKgQMsKj5;p<4Gr21 zAy7(7IcfAK5QrHfeG^CRvHx(I6BS<`p*fg8YS&0@{=kJXh#R`tXk^nQPj+6ja4!O410b;EY@&o4_mnBxg=-2?! zRy@BA$PI@C(2%SltF`!oEPZ3e6O0wX!8lA6wIZ|5$zmt7NoHaRKT-n6IsTL=4}j0c zwOuwDQ@CWC)ESsF$kKSHhD-|AbBm(;li5^RU!{~4MhMBCg4qE#exphW^?IG^AoNG) z&OUZ``@nKX4;ovxJg~XVoY;uRCXfWXW~x)IeTG5KN@zvMw&sPNI8f+Obs=dkDs+u5 z9+6roG6F5LhjIvJh!q-L^=OSPgL;4Hqe??A-)UEBh9nj=NlgrfaE1!m&D{>3x-qH5 zZKI9;ma@so+EEgyhZZWNip!*ja#N_+g6G<Pk zrw>BD&p>ykp~Fi&`Wdndh{ge>V-J%6;w9?xP&!T}P><`oOhe$o$xUr32}<@0O_4a^ z7fbE01w@K|3lL@NU!uRxL_DGvBtmxC7B&V%MsESpSDav|1q)ywG~pr@BO5SCx`In8 z6heM(WQT74lNQmHV@iQT5Fr9&*tNjgzbVAG`8wxd7Itj2VBNu96kRSN*mR_ASwJrn^z`<~UQ9+i+eE^)-n1x3ABz;b3ZX={H}fSN1h2n^@UYq4oACNaL&Oi! z;!R+#-1&+fvSxA#B|k7D69En~+DO>-uZVlZRm_EhN_{zo%q2m_B-$ODv7E5ln8;EH ztH6RpqIR*mP_-LSwb_@0{#rp+BUF{HU8$;Jl@nZiTd;VfR}lpo8tHfdYJZ^P8YtW9 zxY65X6`BzS3aKOfH4Ic!BpA!$T{L9i>0G#fcIr}|$kaGs%N^(Bl+(4^B$?N0(5Mo& zHkZLcT@cYNO}@HS|yf~k`F?`@t-J^#bc)CW<*-19kCEcl%fW|v%Dpf zCi#r>w?Ve!mWM*dl$5wWCI08@3x!d~T2`aPO8F{R1D*`)XNjm9y^y;g1p18SV~*zg zF3tbG3;K@>{SgcM=#LywqyKC}TK+#^eKQnazUAmIxh;J&8>GviA&3n!O$Ky^@bnk7#;hKpD`~JBG|P+4gX)r;LIq|DH^p>+ z2P4Jia7$9W4T)5NrA?C>oCU^2wk}3+oWKNsC-2>?VE) zcTM~_Ey0+v(*Vms$%FyecT2%h-=bW5X2+#!S!0~gIkB{RrI}apMEv+v&XMyT)FLatP5&^kSfdQS-XE%S)e20NT5L|ndh`=v} zmR>5^rT$ORQ}Q!MxG6y%GqW_F5_ULNE?sKo^X(f0*w~&Wqc_(0q{k(x;~6M*I9}p! z&pe&rgwlL)K7~KM_9f2-mkIrs8j<3F;caT#D~`BceEFh{pvM+e3!s927hAWwr<8_K z18}iizQ`Ino9YS+TgYdqyxx%l!szJtOk%4Z{Kp6oJl+InQU+q`OQEw^wf9nh`C*Kb z$u1k6B8`>lR@opWIGbrixLSM?h)UO`_plDi=qT9rUAHLYhB_T{Ez$wZ9{U@Y;eHKS z-=k(E74@|(=pbVWixtx7nLR>lswMNY@|;&ND8l(qc;&7gEKGDhGiX1{Pn%WmC~dA9 zjPYecIk=2&)FLKS@Ug=$be3@i>z>K2EPkEGSH1Wp?%IHLSiTwj5}$0A|Ji;fhY~(A zIRdv?+)*8gLPK*7@WuG26~$iRbI*M4LRyx*eZHTGL;*x19SZV%v`{|4bi`dwOZg29 z*R$d~{bPy=R;WP!DhLv&Rb0(&z@xaKaoYdVyuc=~Sb^YRpv?T*Q5~z|Or)h+8bbFiL~%3xup;AV6_`kS1bS#3UPBdO#6acG`4qzBdV_vi(mgZigG}rHW^! zY^Rg(w@OZF4C^il%+=gt&TwUz=}5Wto6=A!!a_J6^^?hqUX4rCV^cX7ol`$(%eW1p z`ngVJBwG8d`UlNbL0vU62BKoIBu-x}CM0yVtV`eQmc|ze%fZ{{kIl@6>xl}gqHk_r z4bFQFv-n8`B}-zN1dprkc1HP`w4C%97Cs1RnM^i8u32cvAw*yjzNHAT5t@PEX2%Mk zMB+Az6xqQ>MI4Z41Zq?h47QR@GmIZls|JS*6nE99E5mbv?o%j(8jnui1I#By2Rp?k z=h%}-(~P}NZa*kZ?10GMLzq zC|Ci;Zc^?9U_{rH_$VlKrACeb5^;x?rT}MVL7qrpEK$ivtqDkj1NZPNE1`kn;ATY2 zEx+?1Xw8=;?kYEvyhkpxs*us&t^$yhNa0#!GqRMx5k6QEG7m9R!m7gLWy)2?@`^7+0ewpuBXz}S+wmVts z-{{6j&wpw+H!F&=pDpB(1N&pd__;7t^NIam>qr+tLI%43nbY}AMwIv_O!`59qVyrA zy_KJx=vFX833z}=P>gbYITtwMpf}ZqKYgjyJm<>(2YC#Y6n?}ms|A`|A%}ymcO9fs z1YQs+!-*_Q;`k(a^sEy+91uSk3~C291cHs=ndm7fsOU^kTnSfU+Rsyr4daCDt|F9C zuOMeOniXD^`+qgNzgIf&pdgdrcp$onDIx1xfB78eT$atpPMFzz(B5DoUL`5M+RAgQ z4OpuUN+>es;6XFW)oRRBQi~i+qfE)_+Vqm*=M3O?mpw*7EPgJz2n``Beg|?h#Fg_e z#N?P+Har9O?>68z&#G(@e&iGZR*?$WA0*88I;JmTJb=?T(1(KV55$jTVa_qlGpw0| z*7N}T>I})77k=~?H{Tt{?d8)kXxnrQ+5vl*j?g9z)6ualO$Q4J=TLZ|^DCMsb%f|i zac>f$Ot*KBF@F) zbEzQz6{?y}8{&?2!Gp~%@o_}3_Oz|-YC+sGDZZXiNO*?$jx7@=1+t-a#razkpP5G` zXbVC-7(efPS_*)7lF%QXd5{>9-_1Uvp;(+HCP8Ru`P-F@LKs3qyE|_4i=3EBMab?>#g4&jRoN5Gc^nw6pMs}%q#c_ z^V?%gYE9G0Mqn{qssJ#rwMkJ`!YQdWqZ>=+ zY{<@mSpQ^_wC#lggA%707{{E^I#RA#dU$ofIh4My%jzxnhE^6!iqvPmBD(gN$U;2B zJ~x1rmVDlh8VS$nVb%dvF%TJf9!pVs?kkJ(w2b(0V_~!2V#dT(s9UdKb_r8It(CGy zlv$?}W^ixi|E424amWYELQ`Et6tR5UvXOWIzuHDrwl;Hvmk1y08bHukMRufnEO9c}@>jYU~o*Tm~0aLJ$;EY)FHI+Dn9%*iI;)EirfAsnHp zPVsh7myo=HS>gKFS-csBtQXJ_Bn%)x2(T!bp;htsTn%C_eXBNr@M3qtwzAUtJDv{~ zFw}&6EaOM&NG4G0fm5hdZN{kWZQ%=X{*Eqk<)k+F{gHWEf|Z1`{aYCI$^=U;B${tk zON4+J(Q>QZz(i`Tx$fWj7xud4yWSl~gLP?JZd!qDaNqm9`vu)C0Kl~G$86twcl{#5 zL-6eBy$NOUU*_TihxTu=gEGr}&JZ|Awn^vp{0avdUo~;g$DfScvK>j7-S9jv0pR1s zelbz95qcx0gKv`JekzkCKW~{Rppa_>cZoa9+6a!Wm(#x2-4`@@9y`{3{sZ%pgOfRx zeBjiqPg#;6$qvOS10nW!g=!!Xm_@3(Hv*%witgZvxbon-%jhjSHARf&b_rM@V;hyK z7L`^mAL3R82^;?eR~tCOH9MnIuIjaw`_x$97cV{6%|mK_H7^Kju?pI1AQgKJ{yM-! zMO9;V6MM;e@H|gMJD4@blYLmcguplL1Xy7T5{VS0>2VRFgj2GvP4S4!*F~9Wz}D6` zYog7HUqxpI`qR-yUAD8dthz|ioTgjUh9ha1xX^=(Zi>g!4W4``@pQ$$l5hOLB@gEZ*0vfJN`;#_=2*X0U^w1$Ux!yC6OArs?2{5_Az^6#FWh0*IC{l* zFlU?W#{IhH zit^k^ZRNR>+RA@gpOn`H$SS{2pOn{K)GB|oK5730`lS6E^-1{~^hx=*>67w%^vO}N z`vfqIt@qkzwI|-%BVhb(`o-rSJ}Z)izgUGtHuUlj{M~u>Om{Bv>>Pi##h#G@Q_s%u zXQ!x%^@``y$FctLloI1Ogu}^owU88_Z%N^Uc2o$W$@I@g$9r+Hg!HfeMtZz7n5K<_A7bUR!*PZHELTJrfe8;_^JP(%@@# z=PkS-v-4G=0U83nYm9^wTs*Eilk1b4^!d?`F{3x>+a7(pLVaAOZ(q^3srAW~DWB6} zA(`ksfNs-eSW6d@4HT;OS<}%fX^sei28<=~Ic}*I(!u8`QyeRQt8I1PsUVtAYkob+ zp!vQ&F)Ocd?E-!ioVY|=x<4ra9^iMHU)CPT$A~??xvPWnGQpBP_2y(aoKwC699Nuu z+%DgF{a?-XgQ>;>3pU7hpb&&!+nvn6yo0IK$A9gh1E*=~P$nb0obc^o&u*x$b9YJs ziK<;4Vk|+6H7KJ8x@h*VbH`)#MTji5(!&A zKIcywBjNhPH9TC7nKDX=V^wq-b{{z*U~Sj5rKamTKN0?A1RO9Uy;a7uM9gEj+k1&! z_bQ4*S;iQJ2g+`+1*$KH2B3I#vWztthk~Y}T?&TA*$*7ZBVw_jVAi+ARmF}i1W}CG zrR0%rU9a%=`eGSWjuC4Zs2SgZN(4Dy<2HWb5Lj97VEia|XLHliemMl4l zDJssG0B#@MH7O023QDDBFIMDBO^1V{;aHb=in4{}Z%?q8Rd%>ZOb%4D#zNqV#d23> zrem#21*m{U+tA|?4l+2q88Twu2x8bWo3|?>;xh$qB%-ts5?c^zAXgP{33vO7M8w6r z?Q9xB?p9oJJzx(9bCZo$%Lmgiu~GS7wj-knHs+?-;3fk5XOkCH-Fe07nPDO+?y7TE zOy|}0*TmK9&_wR$^X@N21qRaUCtMz?XW#BW`}4F;iR%^|#`kLh)z(Io61P>~Vb z7e=*B)U4k3cu|ExjTAd#f1y!S>_mX^(KSJ*(n<%NR9FapXn)lR$j?T$FuA#!tJC~9 z2Y;4D9}Gj*WL6ey7_6gZY;S`J^yd;V-?+hRR%DNuEUlx&<2GWqf3pyABw{79k&&_D zT&gxsn-y^hzZtulvN?gkD=JKFxWLad1;VV&ors{g}{;#NkOmx(+!Yu&VvEoZBy(8kJi)r z=%g4zq7+GQ^L%x$0kRJ&!#?-P`n+3qdB?5BpnQpv|`E37J~e1W2l1z zR~!;30Hr!t`Pbtf!Dsc}pGu+_htbX%aFexl`wiP!XT$}LcwVXP(SAb-^0D&oVx5~v zif?e2rO|f9&Z4Dlw>iE$aqHC*`&MN3a2zS}kp4S9#U_sl!fKenOsoMG?_HLK%~C?^ z`EqlVO-bkE$S%gBLKa1I)onKRO3ig4aMU3 z?eV6a&4cr}1WH&4LB(WRe50kC>#~!|c#DGCnwG#QCH}FcP$LYXfUiqZA1E_aKr2%} zxJPEuq&Sqd3x-*3K|^bnJn^U&gX0ar@vCVKN2qQ~gn=;)@i@=_Q@#6+TIe;v29nh< z>LJ-vwi-25|5uTnOzG()p@xJSRlarVfMkrQZ-T#Dtt^V{Gj@9Q2|34gm4`+yDis%3 zL!vMx5a|R>>Q=vEx*d;YF~O+%$m8I?j~^s}A`_$3pQHO(SOSvjOX@*#`9@4PYNfp$ zB3C*^@X)>Slv8F*Fw>azmKP>*PA{~Rk*rPDrLd&WX|{CUiUqC;@iHIZpJmQcJ( z&MTig1A0@uyl8D*@!8(1+1jlEHu6Ef>f{wil?Oz+))Xt#z$}_nJP)Tp3BI^?!H$bZ zY{jJ&W-1%c3WQhgF(((yuEDkIvl?7R;ffku@{%Jjq}A9($e6`92eMjzR&nTc>{JJY z!^N3wq|HC$=ze6p*>WRfP?F5E8o1W=vKyo>`J6St5z*c+3-IeVMCD$ zqh#pxHJr8_kBNFp^)ErG1VKOyJKYh!N;443#ec$aLIoJ|9OGrZ-_Dz1wFgUtumegl ztN6m|Ey?_igQW!<0zzx%s7TKw5LAhN39P8vDJCMc?1E89yH#^x(`vluR2B=(?-)zk zenfhs-J?`5;Y0wcE#z_oF5reXke0c}5(!oz1i7uavP=)ceeHxbI-|(7XWY^}2*A~Qum$J(7Oj_s|$yQpB~Laib_y3WRTj?3dn#% zf#;BB@;o?cc6Qh&&28Cn#JO~hPSX|p3YLZt%Z|hhGSp$!F5bafp$#ddY4}y#yh7C? zQc5RMD~Slr=wP*$wqAKW_^S2A`Uh|vwGF9fk4SeXy}bHXOcoVlrwOhc*MQ2 zeZuZ#PK)=&%a43BT5y0j9^>0Ic9x+iR$3Drgzu=^XanLh*vn~J)^pWvd0LPQF0;|h zA&R$26OHZLY`k`c2Ki~^%pTT_!+iL2Gn17OQG?>j6X0nRAk6{ocydy_mNR~l;>{de zZGo0zSt@5SO_8OYg4LVM6pvPfiGxhI#qara!cPR*YTK@HDThMWpXBCZbKRUGR&&;-iR)>l6mY#QZnvwtfdv z<pvh{EZB2Rz)X-9U*eQnU@$+uDgUdt&%sR5Uz->9u`}PmJDI(d(Fo3y)LeJuN z+nr+IH50|rA&{~&lhIuybw(;9a^ix>PHF{eW2M>4WB|F_EMII8L!YF8PS7RE#svT` z#Y*38rceC@Gf}x^I%hGpgY3*GJBXV_D|GJSv)aB^-+8)EG5;%Ra&|0A=ii^GEO?v-ViL;}F<4X5*A1Cq&Veof;z1*T#$4M76t6V;8W4CxHJD3?5YGk-GA1)a zr>+yY*z!Mhjc+dhpvId3{_4QmdLgs83<{F%dYJA70!xZ(AOwxj#KXOXU24`*Xb*c^ z;geRrtq}Mw_UIA>@U@ls6GBDCZBy1{&T1)M&E8th<~YBM^H`pqg&3x+ubPf&DlP+$ z7jMiwRR_`TTEWE4W>C;Z?Lq+oATTcpG$FEDISNqKL_>S+8_(5?>NdimIJjhhMq262 zYdvXD2kX=u!2&+^Vcj1AK|R=N(`0+Ew|3vRgxinT?7E8z@n-5(xgvCgH6!CAep-3X zP41FltWja)17(zLW_)o5|CJ5K#s5g#BX9#1WF-&e16NGJ2XH4rpzKH>vzFb3WB+E0 z!Y)u5lo%GIgksAyX{P}&`*Xk)+_A#;b(6STgbCq~WN9 zxwHM)T2?(3)E1L*;y5H-wSv|}mRW{|LM5x8E3odc;V=_ZYqlEm5YG93b*P^lSCs2t z6pziEnB0K~0FJ%c=(%%UoMU7ra5tT*-CqS|r3f9m&XQICENZv%l&ozf?nW9K?#QLd zjEl8H<)PP7jdekHsiZ%HVGbZp4G`@cCOSCKx|97yJ|OYX`BdXlu-Rms)wSxyb2#RYSq587 zwffX;ykwlHF0xCA`0#Ta>5?<0q|G=kko2ygvoZ!T&v815}N%0W&#Mx)@JM8 z?v+DUB5H`+teH21N4NeRu7S#i^HfT@<=@X9iq3uEcG6sT^JI&=i;&{3 zvRn|l+o#N~eNr0Ho80s?iS<2HiJ}*sRMtPv->3|((zC*oo37oshl-#Y3KDpwDB9wh z)-3~6(`>}LdbXEc+qAi-KcGyBbnm&n`@W|={e>ht$ruEnuEt^DVO{%lS*tc~ZUXfm zuF$Q=5-r{KB0DXd-Rh#TK1*GvYh4HcOV#tWl?JcVZGHGw(X^HlDs5sp7L+d9zl0Rq zBfwP|{&`yF;+y31wbJ;kZFDB-9Z+12JzRrzfnr>4g5hgpE!n-HZYV~M*Jl8{_tU78wv#lM)vQ}Yh!L)8M7z`FM5;~A19LO?jjj?f7G7t zd@q)zs#@S$2&^N-YCPDhey8|H!l1P=s~=qvS3isR4Y#WnE^Afm5HMN!L)UJ zngBQASoPD7#kyImhs%u*#gDWpu0UgcPprzIZc0DE zskZ8VFS1grZ{K2@I zLFu|4`5>-tYAclK2ewpE^_56xbcmnfGfOofcx8P^hs?+T4#$aL=QWR~^<n-Mo5+}8Eq&xitnUM8Y*Lzj%BLI;_sin{ ziw|gO_oo7=a!#j=DXor&GP3qI1P#D)`C<-bD>8V(k2rl!Bm7_8-`c7t1BolXgHCi` z=;K~}0@0;@UrXNCAk-M@)!m+!Gp_#bvkdXBFx0Q8I=}DiSHIJ%Ys*L=IirU-Xf}MA z)Rqj(0I$e&x{W-p;$;-uQgQJbNam+L`6%osCABXOqHoZ6?%(kFzI{U9KBs5q8rOa=6>yy%()y`e7pq)KxXU~VVwtHyj)A|A}*sapE zaT6^P;U0eN;R5&mGwO}MBttELsVB%ebO4dKT(5BMz$1c z+@;TYWcTr-`pi>UNwxEf4{1Di_S?B@sGTKiXJ2TC(7b*-pH@42pK8%%N%cz`&rSVy z?i*_7ersn>Xy@v|c5YBR?>`O-qw&1k#&e~$;{aOVoXmnMFv$l56n(ib6Kr;?>X%Od zG`!UkJOH^2P23+ltX29-E+g5HE?FU~zMBVX;65HzfBiII5gNEl4ZO`L+nv^ckd_v% zrotB6X#Cj2i1w-GkDtu!Lrv-=)fbF9-9$}jBL6`yt?NBj$huZb>iPyARqy+E@bF4| z2~|}KU-tQj!Gj)y9pBs%zAc3E7t=$%sJqqL4@6onXc{3hwMLG8YQ@nOK)jf;uK)p_ zN6~#Y;w6egbbPL#Zn~uGd6fOm6P>AfS;(c$?uhix!Gfny@Ea6lkB3HyF|MI-7bQ2P zmn+_OFNRXi7BBlfrHEKHy+RinMUZM zgZ!$*;z}NC2k%d>%!^(K83&3 zXP^)VWi$xQ)Te_z)r3gyXil~!Fb5y#@~*AnYgQT*Ga3^8+{YJJ*~0=tqFhL*lI34& zB^{3yz>=rbDI=|F8H1%V`mW0k2#6IF1J#ndA!ry$ai~p=7A=8L z?^h$;DnbEFmz-e_d9jjJfHH!u?$fn?Y`A@pxuK_@%2!*2b~vNf8AJsJ9O{HDmq!a zP7WDAo+d@okEh9wqn+mm0dz)S#FP~bYt<7`a2+554|Apo7&n&;`_{#L#l;P7zij8% zW+cb1gXJ(k(u1yXv2gJ-2{Wl?3#67z;hP?mTYc;Uaj{3CA)(wyz8vW{WiHv~(Zt-n zMsm)#R@MeMJ)OKmIHe!&)F zB^w0*FQ+c$Dc-B@X;MgJHz(s;QCXN%4y^`hX~n{-p!p}C z{Px88m0;F$|Hb<3LR(lJpd#Pc2t3}RvW@>M?wL-9kcz0uPf zweq@NB->Ru9)6wwEzZa?%6^nz586hSo#e4RFV|pkIc#8dW;)wPM#!qpHiV}f{=$2L zM^?GuRQVu5DXr(6x1Ele4Vh z#{e9Kg{n#ijgEh8wHKBQ@Mq*gs~b*`m80>6gnNZ_I3e0*OAd7akdCU=vvPg`l@*3? zMW`8KqYmXAID$xWy{huSDk~|QDs=R$T_*Gb{gTvd0KaG)3c9swl@ND7$VHj`PE5Ut zFsW3~V$SHJ=Aj@_4%DeiNr>r-8Nng!?AmbfDLBY@sXAF`6zDr@RDu zC6Xhob*MsNu9UpG$OGo8aAbIWvT9k6lY~ulSa=jxnkv3IE0Lg)ln>j2Iv(=EHIv{B z>1cL%fecx>T)BWG($?X8YmrZ&*Z9p)*Co%R#;jV^_lsDEr(ELIL(+0upimZ}wcN4_ zng>EPuc{NOwW)4#UgNCg`~Z{%m9bRjLUJPV4vk+l1KToIwJy2aGHxTSEZz>9 z#cpOU5{>*IPbRQ5?b{D`yBfAwWrKVlEvUEvctUbw5R*0^&94|;$Od`}Vji*5C9FRC ze+0$wly>>53XqfyIFE3Ik%(dG%jCH(5ruZ>lQ66NJ4~X&sxZtNZI`X(C976$nyE0r zeX7dzP{~L4z7{RucP?OM9V+!NFl7ZSHS}@bVCc4erOr%TT4zkBZ~>yNC{BHvt}RwQ z&&oOzNJezDbTxL5@K6atmBd&wI7?7jdE6~bSaaGVci0)fjafa^xq@Tag)6Kei0;xj zQQP9WwuJdPV@v3(y>tafvU{g;oRy;jw1fqOv7H*$8KEI30_36ngh7M7qg7j%JO$g$ zW^yDMq19p$5qw6}Uw&AUc!`gDu#m_R(me}+AlaWdOv?|Qin?jQObpMPl{x*e)tNoe zligF{H0s>@gOyL^2q&`U&p>@k%X|JwC#=y2mcr5M$71Z3rDe!Z>@8#%i#e>Z61e0AGaUHKEC-xpT`|Xv5%_* zPdsoG``A}8MOi6F1F_f%k9|%|mwi^dTxr%p6}2)sW;&XJjwZ|lC(5=&u{0}NTIf@1 zH8z;OQT`eQu4_}*RP?4L!f6#Yql>VT%wOt`rbq@v{-re2&c1k2d3-CX=-F}7LzVH) zBeEN*=BcJxo3mP6zSPCiY9;JLo`>U!f$bCxWOYW8+BL{UH4E-k@rE-FpIHuEL<-w-t5hiqva;_J@UdH3Ay<$sa7hZ#NCvW8LLsoy!@ z+nK)<8`bOlX5Wf!zhNSsKaq32g56kn=epfWRr8IFT@I3C50ULT8BSOZNp}amCL2pq zkn;DLE02y2M2wS;4ZIg}XBJLMJahnICKu@V^Zr}gj~veoBIz)sopaH_XVYIY!P zKLy_@n_6}g5U?jO0lfk!{&k+9#Dc7kPI=q6qWtv~2;j#GQ^%bfXImVkV>5PaX^ylU z%^B!3-3Jqz?HM8h#C)|K2iN$Cd`iMToM1z!%WCqg)Of0T#f9c3;&AY-aW5Qq=l!tVF6 zEIPs(+Fn67D0)nraGu?c>49eD6=QInT+OX|kbZe?}ad}el>9+4(FBOFw3-dFZW9qlGiJvzMt9MBzoYn_k% z-FnuXZ968=`SLhFExSK;9#9ox5s?BioRHBFN7QqHz9%(12OD7To)Rr^ZfJSa-$qu~ z<<>96q+8g;%Lm@%uvi>jv*zp_xf0+}mnqXsF-_3e3QMt%@SBQo^6P{mkuQvdGPw#$ zDw_T)cg&|`C~AW^7?DS-G<4lri;3SNh)+D~)i8omII1M&ZYrlp7w2;|a87V#Vpf>M z^YIwVvmp#(Mpx|6|Lb@-%q}jk4YRv*G!w|=u(pREf zPjor*jJ+z}1Ol^CN`7Qk`P*75Ug3Kp%=_Xs4-6c2=Cb>k%QuDLyk#_;@`jK50{p?~ znpR!phWl^C% za!n>{!9E46ob~!9BzSJz#6ucPRa1zysvgtEwk3~=*FfgJOeH-7&-_s;E{0Pdm}yCy zU2A88MKv{5vWw=)x(po1_XCF4w1G9Oy-khDj^|G7@w;Ai+5>&6HNz$xV4>ZCps4m% zb^s@^Qdyb*T5$Zn``?rD_q?pkD`HFc0i&H0QQpPJWvF}D0l|b}3?By1FqEecG2wbP}A|fDO zvMLFyVow~5U;)n)yD%qS#3l^LXRr+7=W$&w8(jzv^I?GB4Bu!ul@z@U(SDK{KKM<}w z+|nb>ND+8MA>K4HfBSdH4W zog7%XzrKf7l`W7{AK_OWWCui0X(uO^}3Z=NPW#y)l^DrS8#gA z^20ZjVZa|htW#S^tfPYwF!#89;C^^b9CIre&+x< zp&zX0%qr=llV~yDn_B1WVPXhmH)&;ke)ZTSO@at$fmqq+DYM~4E7tqA3dmES%f|L2>zQ+JP zf3NXDOeKw>PC*mvYv)flDwG^^!u>%eWWqClI-RLHlfh$smb1!5G*@1_V;I3fB1$$D ze90DD6yCGSFKlarwS-q^YdZxOJ(e`-&bpMw4>G_WT|l%tb_T z1A5H+BL(;EC9d()wk$*R>!&rA^qC;|=X)1=|{hW;Ysq?7J zTxLWZDPKg}eRG72r9D^dVBZjHBq>eD3XDPh(hAtxvkq=U)`xd|pVe~{cR|>ofv7)q z9LC7cNm~cCVP-z~=;M)Keng{-6X^oOQ4%I7gFJ|YQou~jYF@4+@?-tzRttYi;uRsT zZcWkuF`t-j zxX%_VT`}K<;fQ{1=H7?7c`TnFV3$uP+30^kgKqvsLk=dahV>#_s}K&4PAHoAB7X7> zvc1T^LDd()B4`wZ)dvEjYFlyswaA0_M>(N$L1lgZBv65&@zwlAs4!%m>-WiqLD~-$ z%+~yG*u1SJbwDS|BG!XCG?S0#ZO{MF8oFQrF2!zbbNv!tG9-A>nm8iOQ|#g+wi60X zR!Te1oG3+0OJ%^Tm+9ncne>c`M$;_cCR+fw{H=oJ#=#?E(OqbT{v!#E9U`tpjf5=K+~P{_)mIdL-fvp59ut zGRWFtkY;^)(!j2Zy=VgCd9B9t*L>lcm~fukQ?!dQk{!#H@@`N9Ny18@+@g=4T`QVx z=nh|vY_N?CP`OpYY&u?JWy77@8xkt%R)l5q;z=`E*d4;Txy($={cj;}^=&^s*2+$^ z$&b`bMnQ2^!AMWDzr*0AtN^|{Yfz)vV@$VZvr`;=pLGE`CR58*5RvY#G}A&OBLPw$ z?PR0=N)f}a5XI(Aqts*m^9FN$`R^C9a#R`%gx83{h9jCI(*^2D8B^_#xz3>786vG&NMW#UBk7LO3Jy)T0 zmES%&=r#wh;;>Q*5L%~)>>g?3^rqrAI1v2p`FL0LdQ4#z#7cSh9c1u$mBdY+%VR@*%o;nnqr(Q&nC;B zBCBr9)(lG8GhAc5?%$xm{3!uaVoMBoQI;7<@f)qG>Ly-@36v1B=xtN$gaj*Pyg>6| zAIP$y>=PW)>WAt8DO|GoCtBs>woj)?Eb~!M+BKYokKM|$uiLuAv{7UXNxbkn>M=?A z9fbUPW?%$_I=oY4UFqpT)3njM(uvZJ%&nkRt}!ca$wvYHfkMpBAGzhT z&6)c%y7%#F4}tej=b1zsV`Du+>T<2j+5%3i?N?TcF@a6N38Y?zqh^%*38-yCw;DUirbB;`~#c0U9GepI)r|wslk<{AQGYT@S+Z=(zk-c8@oIf9l}) z?=LNR{*I4S_m_;>wKUWBQwB;8a0X*F?al;)XWFwwpYMCtf5HBjUZ!ka2 zDDGECt$Gv&HJp?7O1U^yK_*3vlr!5=^v$7{f>1>-9H*yEAo2r}18ojZCMh!qj3axD zbr4Z%=Em^hb2z^8(*|xY+>vsEh3S96Q`nJ|rO>oKDvuyWOEjGF{TLSrnJ7zRq^=^> z=Ep0ha12402VxzRbRgQYGru1DN~$cIS(NVObq_UjQyOgFwJWNtfkRzD5=kW&IS_5-h>%u!HBSGl-8*$A_xhPIS0(?U$+LOrr(kWyR~ zY?ZaB9X(jBT+G8hZ}$w1&72Ym(5wwIutKf(dSYgUDi z3**)IY-0jF^r~%wIt(UZiKb{86=2k~iKnV*#Aw*MuAL`FPzr{i(zq1=DWe2mWZPci zMXCUgmabo3oj|fZ&gkRB*m7^LZ26Dw>`qD5a-KrNV;i~FpGOTm-6(bz{U&AFjdK1# zw6joyME~U5PVz@&XPCM$8jc~&5((b)0*tT{3Vt=*#ahWDzW6-wufRXnEos*8677%! zj=d@V9uNL|Oo2`*c_pWes9asDl>`YxJn2?SR4c9rRRLtm1n_~rCqom`(K@;XA?(pT zYCoD`MK^1$*fYqyW-XQEpgnuQb0#4}5WpSIVp4_+Ms$>z= zI~*rbImv40T=ryt!takSu1N~xlHa)}%J;;UdCkHYcT;)1KZ1?dmD*C&Rt9?jUCNrN z)i^*ZdbNm{))^xGduvY1tn#(E6&T+|uJ9(-E2vrC_m_GKz%y6iZt(%ARv4{fQqFU% zt46VS2v`mscOlZYr0_9jPq@o9Q&#kt`YW!bN#X}Vv0`0|#A!<5_WH?WBTbphAv`N% zj4M1JlqLNP+L9Ru)<`f9G(A=aw>S)ca}@sMeRRQc?<=K}mb2yYB}Y2pES%;4gtC)- z#|W3|hHAL?H`@AVfGm>Bc7ien0V#Cz|JJgq9S*u=O%I&N-eO7WAj7kjm}`+YLvi5; zkv3cwl)AHh2A#8Jt;~mNb9Q7eI$;(ab~PF$7;zLG5^bRmDOeauMeFQYOXi17L9(N_ zFwC28sT>IJz)Vk%zz=nNvJUK#JBbhM{p`_vGhSDAx0hE?+!M&DUoJ~d@n0{0V@HL3 z_O4Bj*&XjnbymUct-0YOC^sqDbaJw>i0>R8w<&rSu!;w3%KHX`hZXUS!}!j@aRL;l zo2!Vl-TM;vxK@63Q2ygUM7m?RW|qg-oH2N~w%;CSNQFj>!`Ia&|1RAyDhnpRrcC9W zR@DC2cjT8dRNl^C%-w$>DEW5Gzc%%mhwa(&tzU`C-=khYn?q-c_!nl0HRv%lqW9sQ zFX4Ut;2+}M&ZCalFVW4Ia1g#?K~ z3dK3I+lNyYYE{NW_12;C1@(8zGy&@(ew&~iWs0VwOKQgxk{&#mE~2^YtYtQqIm06y@IlyxV9DpNf0Fv+}s@<;1UuWzQ7T z<(H!^gPfT#Q+tiaCYVm2=`a(8MHJdN1Jb4#9}u)*7yZiz$C7{3zl=PJ!6Oh%Y0>jl z03aI9@P~NDDCZHy5A7(9y+ja{qYSbJJXS+FwCaUDSz;{=^Ffr<6X{#_!^y=I>;RLj zSLCy_Fk>1{hXHoy%H&sz8E{pKsH)>exqVm>X5W1W> zi#k`%>nN~(Iq}Ow8!MQuu4l?$yQE-B{jv*I(Yre3Iy--Lk@92o&d?_`#GF$LyT3A= zDY};o`&(!l;BhqO7HuZXi~igo=gArP1-4%x!;McJpw9XdZ3Rar&fSTs$eUJ_NLF`D z@>irkdbFy2c5p*@|4{Yi+Z&kXv0G-tb$&9IGQNDsHNGBu*6d&{y+53xJnWPxDo;^H z%i0?Uxbbe(p2mryuf>duwF^c3eD0~Xu&*Up<^w#}AOOVlq)cuQeBx~3o1wa0S4#qh z;A7~4L;HHj=4@N0A7p6_j9Nr+=WMV>#6*+_Tp9KOWS~E~GDRaI7*5P0rcm;Cmsb^hZ)+cxUK>u}?D;jbwfn$ATtW*xjgST{ za4CSi(`ElsL&(l>LMX`<&;pd~U&>>$RUtI!qFZAhmPNb#`5lhHGAf)KRF|AIqDXN13x7W*VIFaYZ14`<87v3s|xlCMW}tw3s0Yld7wETzb>2= zAW$JiEsY1HhbkYZGlw_^`^D#`;9bC)R>?M7#I2FP7`}uw5+i&%WZfJDAW+W`&#FCJ zAEj_4D<{sGr6WG6E?o5o=OZ(;oY;oU$TZSKjED|Zc$h93l|CSuDeKF@;yfQ+tpdle z12T@yjaGQ?p@YXD!|;HQs6ePEWwrr@3RuiqtDT)`vjKVo$V1SBMzr~k!IS3+JCDls z{5Xd4mY8MIk7huz8GtR16FxA1qEk+=*m^?0kE|0t48%YFGO)Rv*r9Ar$&ri&E=d>x zsDW*+-#A#yf~>87-VB5Eb=TtdjB^TJVw=U#Rnv?qD1tH^RLC9`--G5p_W-+zX z+7uyf+j&NT(0P}uQBkyhV^fWKJ_YGnNG2czh1$K2M7w5=r(1TBmShd!g|7XXYg zpwt-9!EzG4vetNt7Cvv(A!%|$m(aO%ayjPw#zB_d8#;PQr82=^M{BA7w&4+W=kN zKX5Y*4?)}UH&{z9715m-KeO3uV(fXZ62f~`QPS#-swgQ|k(D~pXMqiWL>!E~C~4Fz zO6s#Y5Q>t<;}u^Sx&DNrq^D(jaZUwGI>zx2*zdH6i2Kool(u{St%p4yNK11o^&zmkUtqTaxOWEy+2 zQGWqfN~mOx>SKv=r&35a&aFXgNPgwtRpW5(>duYcm*3(?1I$xVKFRy@)WwUVtQ{${ zZ(kgaK{8(iel~d&@VdFyMB3%K_!5dl#uY0i(Cg5laj*2+|6>JkV^=v=}-<5Ze zDKkE`XW#IM-~ujn8)==$NYczWc<5QY8tY-OaqhPB)sV1Zal4;~VANDstlh+^9Kk=O z$hAAQs25)1!yq353iuS;VzSp8aqkk_ij<`$0s>pVDYOhIeP~0-iiMDbpYq6xZP4n? zwd)D=)P;oxKNC_`?FHY!`9_!heq9+k=1kX2UN09iQUZV7*zm=nMjU8?`p0B9^5Wsc8)Qf^ zkn;KmzWWIud6>#Go{D@PZv|6F&wYrIfM&n4eLp$EcNOuQhcP1)BPpU=c*%Zjm@w5^7CiD zoPKY^!otmW8ZPbHV;{X;chRQsGQRm1Fd*KiuM5HiT3ZkuM_E_!B~9YjsfHetHx9NL zbhVI(%Ewc-{O}CBOv>+eErYZCeD^Hapc+z>;Mr(l<9)X*7>LI%8SZ8Ir_*rt;07E{ zEQ!QeVp8mFsU;!__QG-d6Ybe_wZw`EmS^Mc8@uIqBy%pX(vggW#gS96Yawu7w{))P zQj@mv*)qNErVZCF?sUgeQ$$hOd{Hk6#lXeHvKZ2A^V(B3Kl?j_ ziH$S$*8_A~?`FcaueZWu{~>83gy8{0BB_(O0EJKZ>u8s#-oocv+rejAsqWa*^93=z zbItGIeO8U_DmpdoN3c7Z)3b?fB+^pfazp+(qRx?qZi5$}kJy{VTHiPtH>kV0`@CZx z_oHv#_uhqlM&0$#YMKWGQ5)p}AEhJAn`2>$MOzG01jw|;lcc<%CwU#`|Cwz5#!vp| z_clHD%ced_C!&_N-D9yD7{ag{NVIU%!YvED9CV}dOQ4(K84n4Q>K7Mo8hz!BPp36f zrG``@>l?CnCn@KLfY};mySc~&xLAr*18OfS+@)W0jw|&NR>*znlK@8O54iJp-z~Pb zc39N+Oq)>?8#!aXR%vWv`S%hy@#t+hc67tO&=jOFOmBjzr94Io#4g71$6tQ0jjA34 z&9u~n(NS2n-)7aIwD8Q=XwxbG(mi*vxhPrKr@j|>uX>)`5Gf%y>qfF5ZV)Z(+qbW7 zV1Zna8@bmO?0lgwxA4WC_0lp`V*&LN++{;DNkeNa9E$+T#O3dqS5sY7OLUjU(^%%a zs$~}HjiHJOmYcG-vu=SOi47^EMr=X*-A3z{EP|h-b*tAW%xVJC+Z0_myVA<-;!WDK zl^a1i)q!CDD24R+5#W5}T1S9aLF_*^h&sf+#t6Qe?}lpTTH)v>W9^ZesG5E6!oogV zgnDp7j3!>#TlNl+gZ+u+X?X?4eMJm#Z&~0!Yb4A5EQz~PXvo=5(SK8^A}1(gouD&3`Y>s!L!&7Mze$?Cz!lK?Fu-?T$1vz30ta2 zW|e;@NaZQdWFKs)z#Fkb^5OXJCF2J=>KgH7x4sqn;K3e_Idccf0oWD`nZIHy`yg!N znofMS1MNa8f`G1fn=K2^jWI(npKHMZTSxRsnG?%M&bxU>NtVjJk@zidxcO)~($ zm~^q%P=|y*zJGnq{P1w8#fk&) zAoHC>-r_(gI%mpX+LbGwKqe|QkF-c?9kyv(jgk?@)A%MYBd_)GpaFIOSIE%jGFMUM zg_O(-gX1S%T{qC@cp>^4KW_B=UphF7h=HawYTE;gF3B*6K-vpBJHEJ(Bcn}Kh9^V% zz?tDA)~J-c3rq{~D9wkg6Ti_JO zH*+||WLt<{TlrzFfI9TePZRmJGRoF4J3Xo=P-nm18NWhyQirOQy!KQK2HPX+OrQl4 zYtWF0RUTU#Hs1-gbg*(>SmJ|r$xLEfsSAjKVC3(9cr@a>(&m=fF~9 z7^RjR!DQid2LHM)(9$msL~a>bmAOvPGur^B)Etl8H7Q08M>A?}G)-Me`oeV`zofuR zt-&1N7DnnXu~`|<5#N(@!8RgPNqLYVLhu%+W-t$7e(5GVJ=*vpZPUPWi+HD+$dA*o z!@ikUcB+IZCB%!5(yJ9(|fW zdZtExv2k0t)y2H1SXR90t)G1BC;K|(8sMm~JFAjkn+U(`1yEj3%e^Vmx3_?H!gT^i z`Ms%_{E@rWU78yk)RTNrkEcP6pM|K8(vET+r496r)(LH(;i7DcaxPPN6EbEiInWy< zkXxK?WHl!&G0msc4Q=)|X+^EIw0!*bp@J+4W!7&8kNx;18L<&B+YXipg3?P@4kn=? z5m7V(fIlZfv^RM&W{LHteLUVj7z97HEG)g$q7>Gk6U@U33br3K8?ETvW)01!HUw{# z@p!A2abM=_dENW!xcnqL7{4(r-|-K&gYoln;=oJTJceEG6o3jL3|hxWlL88{C)?_y zyX1I`-6g?BcjcvHi(i{@BqC#|mK8o#XtW=IeUY>w0P(NvjGWro=FBSdHjr!svljmn+e9U1X$e37a}(6e zn4&O%2{LASCT%m-92vrw#PvY~8xIrESl~a^c+6#F*+$QTmFql4i5pf-UnFjv&p(ly zKdvM$J&In@G#C%cU3CU<5Omx5-`Ve*_dF1NKvg2t|??|H@y_4{cYtuY>`5>uU zKQ#`m^X190wQe5@PN{W1mbI>Tto8bxgm(a%}8;k!8Tx?F0SNTIXX~>w3pp zuisH=5Vg)O`7&*^4wZT9d{JgKt=k7AZmsh%*7^ySV7c;J8Re|ie(MPBn|Wc2i=CnP z79zzzLccQ5%=#Gb_wkkyytLmVx0Y?NH1%YoGZPn}emaIq>j>>&F|4}a$)|+};aUHN zDy>rIY(drf(bbCF z{)1=sh)P9RT62CCEHZ6m)K_P;mJt@yhok&AQ{SabSqBU(^B1O8aJ9VkH2CjN&|&HOt(jJGjxxnP&-ANQ+E+xLNzf*l&ZJ@Tky+a!Eju2fDi)EwgUR{v5ZH~V zxW|w`t4*N$Io4_ zN896b53&pf{qfy#73lNRM+;>;*IKqp;nW&aO|CRQ?ki~f|TX>0()36 zu(v_8>5ee5mei*J#QaMIV@or&U|%Q-AzV^yr#ovH%0rX3cPF2>Eyj-7+2oGgFXIs-Neb57!vJyx8DtM+Vd7n)14s z|8#uA!)$b;$$;9Vl;vMdjjKIO`Ph!|dh55Vw~h^Oh1VJFl*fzG!Ncomdef@-K$HFA z*nEGA2G9qJ!-qQ(U%Ba}s3*IKO9>Eb%GXrwuc_MijyM%0F8r&yY8PWouTf%md8cUj zhb9fB`=sB}8OOpjIwLwuFXio@itIt~qiRKSF7H0YE-S=IyiqyZ4_~zN6!ZB6AWDy_ zp+xZ+4VdNSe@I>+U&DDp5-CfRqY4_;C#$w*Zo1p*c6%OPb!2FFT8x~82y_MX;rwgj zRg=vtcjEw_#2y$uv$xHae&Y&S{vKT;`(J*IsZ^axf6!q_J^=mdxei6tBG&0rUHOH0 zYs$2emY}4>jCIG`ReJOQhWtEwTXi}7B{5;TVqB)9kdiBd4nNRtAtz|6zS!Te+iI!6 zOcDA(3U-WRfJ~Ij=Q3%-_${6`iyoh0ES3+aj8b{bFAp=kHz+~~7#_~RWge`YK@(?8 zVdM^`(d;MeZhYBriUcuDRP7a0=yJJ~G*mQB>6{^B4u?@|PET;cyt|5spv<9T6GP^t zO{#M208PntfILo? zXU9uy%B-5w^~)~HzmguWIwl5JAo9qwr@COOmAM(M=S#JA?UAwdj?>C(*5#;7ECk3w z!uGKw4EIemW@WC(L;%oKxobz$UFK^<<`!eyPO_D<&RY5PsD(hj=*wlHHyJw)D_3z* zK&9lW6N4eEQFJZ?5{FwlgbF;G=C+zdxBV+l>ec%KfAu~@RD-w3=Xi#sb8ux|a$eyMR76VlIRbuI@yf2I`fR*sjsO42q%NRj2vme_rw0di6V9g?YSc0fE z$^Uq?x10w0m2>CbH0|t?D#B!yXm9a9NhtnwpUd2%%~AOC{5r;V$O0EP6YD9ugc6K- z)?WH3^6TD)jy!(OR8n4j1&$I$A%`kYLQF~gvA4(=rBNJ)b1y2qQ1ylJ{h?pujjDH| z$03NBmG}MmN%FBAdpXBCy=&Os99?wNGak12BcDNM-vVH)h7*y}L~j_a1d*i@s&D>o zzUi;7xM$+V_Y;Z!!z+IChyQZNhc_(Tyt(zCzk9HCs zhkobcE&p53U3mTQwI`nSF@3%MeEsqzjxtJ z*#irkKe_+L4?gL&@A)ZSSy&iI$YwVssF~FUo)y&0-x{fzVZ+jq6-^MNZ8G7|Rp+sO zD%v>dY_(EQ@>3l{SJX)Rl}`F0adpt}NIEHr>t$=897hx)WrGHt;r?`pH`k;L(-@dt?PwwYRdW z+9#NVddFMK=Hm*Uu8+?L2V(_SL|YHlkIA%lYA(1D!d!w5+s$5`B&~X}d$kVB6k0ZR z_SttDlR$B{Nf?)tl1JdbA?{H=YQ?=xUp?vMUG&(b@K)H75Ab!`)N&NC3V}Tt96>)? zMcwTW$cwi$cYDyQzUXTx2^5U-2`1$o+H%Z+HZtxnB49Te_ZxRKlyZ8 zFCp?MInib87G0Bc#34I+Am64LhKPp3Lvk}}in;`I)P>*e;x^DL>f5ex46t`#p;n&O zW%E`hQZwmMuQ$RB305P=umzyXrdzRuov($cC=r3uE3Lk)z08X6#VYTE*Q&7H@m0GW zRNnVT- zN{;`tGrf6?e)95BRH&m4nea4!)w20Ma|)fG=pzl<_5iI3YBXKyC*EPLbzQ=%f}`h) zFG}-g4NQAr49&j)us=6F-RpL{QMVf>-L%#2z_o~z&>hIa=)f3fXn&Ya_Lkp@^EW5* zmo9xJ(sfkBCD-#`lCrt<;=Qp#oJ+5sqG0>di_e7;OgYt!(Fp%d>-`?U$E6;@OB8-B zh?NgD_}F6j281Qx5@D?;AdYeUd{3RUS^wsSw`$XL2jB>rA>YG0uC)BEe z%Z}1ajq4~dYbi$PjRqO&W5JV&qSFB}4O6o7G8T7ZDchUmjJH4=7|k1z#n{veEQDXr zRV+7^SySErLdz;jjWrZlqwG{}R~(EHDNYK!zcy{#?a?LR1{8OxX~oHcwgn@(QrtH( z#v0h9Zqk^iRDOiL12wsa*CioWpzq#;(sx7gXZC8H$b*C;tbu0%xmmX+jjK3G8!jh&AiJybosJvV;LzW>A^%s|@}m82lo9zRHXT24D`OLtIgn zt`RgWDX}JwFJCWoI^h96XV;RHN){;4KZvEC07!{%aR@JAH#N(|`uT4B0)4_*sH)po zHG1^r?TM)}a!bYVsHh28frF8hUypESyoXi4kN?IL)uDnPV{6SQRGoFFqM-)yL`5Zp&2v`&(^+3umZM zH32@`7=HcZmzz@d3nEAl6*}yinE^e#Lm9gzqGB$0r5+DN^ z%-xp1Dmfmct5hj*a>O%SOq!+SkA=B|YDt-K?J{;PsgZN>;bD3I-&oE?ordwQA1l8? zxh=T{2`8F(%?Aht*{);8n!FR#RWsAnY^^Q({pr2#y~x?D|Ik}7DRSnr7CwT#5;n`U znySB50OQYA=)3 zlr&>EqI9G4{AOt{P&q+x24m)OoMEl%bjy`21mu@Bqb&i|-y)fAx1t#LiO3lZ?p~Cs zb;-flQfw4&*AMYqXP%Oo2|nf%=&^lyxnT#6>C5=OVaqHJ`NLAp?7aB2l=*0l4kLDN zVua0MKlXOa+OWy#F^w}k0gGiWO7x*KrqCD*iCUwUk~to!Di5{HsG z{iFPmx$IE6slKJxZi@HVX!E^} z++=R;U~Uy#$W+a*E&~NaFt#-4+B*j$g+ZAX1 zl+WHz8~Nfr7nyQ01IX~Gf$nrp)gM(*O}yAs4&?Wa+ZtpRNsSU z+xgGRXK53wryzP|;{cn~MIL?826>y_!(NG8Br;%Q2Z7n@l`S`jCjhx8CX=`lZg@`D|bWN1d&K(vfTjoRJl9*yAC_? ztl$>z8^S0}f0z45`eE$?{M}h>lOk*@$dSnI?z^IIUNbD#=3gNDdS=!EvYn^}8}4FU z`pyQVlj7pBg3jYtiH*myY{st=ACKiV8@oyy#K>dG1b9E}2q(U|o*bh^_MZQa8%Ayx zm9fNZ!wMh90I8QB$E&vBc1MD5P5!EsTjb2Tk^sR2FH^<^LO|FefF4MrW%R z`&;y)y+k^pUL%j+U!-ctroIlSiGlmXB{(Yc-$?iG8glGfJjX?~GmI%#7DhOXi6qDS zhm#i!d$iAw$>-1%@MMU3xSk0P5RpBLA~?zZKVynWlq_PKqpbidLzV((Km)!mD#$Cf zx*fz((f*}5%O{usuj3TBOVnca>aX>YvXFNZk5raE5h1UOXZQW6xW;{jLSmY8qK?aV z#&jBD?@iny{%&Q`;15O!A`Ic{G0;`5dcWgI<=!ut>b(T7I)+yjLD_qSFs5oPhO7jo zr05$}X{p)g-7%+Gc9}>+Y%%}wr7lJ?lMLVNelPzi4{O7MoI6A;ZM+E8ox z&poj#!8#Bk^vs1?O0(iwc7GCgM&iY~AGqW4paL!mJS^c+#Hy{m^;Lcz4DDO-@)1MQ z8bx`({##jIu&CUGPuYnJ?}q6uWXBmhcZ3lzHpwPvGE}PNoqql&R9#g=7_OA1sq{yOqdZ=h33?%Da93=h z%Yb~EX-zK6@Fpt399|`@h)8qns)t7@w8dK<&X61DYntzEVqVBsiKL^dA1} zRARz5!=#BXiUCUd|ZaX5X&`Mz|Sf}~h zQ<aK+q`Zult5Z(P(d1XzK>DRSMX059hFLRgpYGr3u?wy13i8@Ll#SIDH)NNI9 zX5@hlypC8gCDbEu+O%SX#ij~Y;cce-4xmOPCO}*oc+|?@L~Zfd-mMRD(>Swh65}VZ z&~d6W9owE?CWpf^OGf{c9cN_{3>9P%P@k`en+)$xO@cI~Ba9+4BE=;k(~@14vv#PT zW2vXow-<>9crIKO9!&BJ-Bl6i-%RQ`2Yas|fNs-YZ(=dzAqfp3p8Pr;Hp6O3k7dbC zqlAndAu81%af)bDvYAu^gCO!=3o~%?@GVXXJj32P|^ z7Jjs5%WK{mm)G3Ls;D%$DJxP_fK2{~Fx>F0q{3`X$gI~GC*4_L^m^J@k%KG4fI9S{ zQQjXT*y5S|Htf4#N5KE}RcB!U!X44NA^2>TJyv+DK`ciKy7K+FasFF4)x`3%H@L7` zhFq;=W3mcRmmwET)u?6S7Bv?&*#@YP9Lhb6V%;mQc`JJ#EKM3^ z@Ebcl1|f>dP-TeNT$az*HhV9Q1+<|6ldpVIUDS}~fOF#ywyosuGv`kvs zn%7sW_nuh`&Hv9AL>Le7h`s-ESRC3FI&lqt)M)IMhY;oR!sEc%-L$&)Q?w= zPyB_5igzd3DI>g060jowI37aNk4}k>!3khrpO9>pVwYr(Yw9!g^L9#J+IU`m>W!Sp zY45D7^f^GLsnf^x9A(rTBR?49LPJ}El*RYs{AU}?Ub7x@taT^9o@2QgEowr+g=h^b z*}Nb8&825so(*r~YF(F{nZHY0(9@DCQ?RYci(BMZ(N=hlzk`4pjEIH z1llQ2&7Ulrqx|#Z@-M)j-q1nOXL=hHe_Gl&(0LU z18%#JY>iU^sl-L5Gz;QR+K|DIq*6CW!Qn=~Gdzs8 zrPiWi(l^$T<=)qMd+zP7%^+DShRNl6BvAqmupNVS*TTAn9%ENXrCGsqr!+>f!x?#9 zIm(8y&e2#>OrJBm-#jHA zKgsSGPP~v`m|FXkvf14nMO8UMeb=9=9AWoP=WqHfw2z=WUJ|q0EQy(@93iW#kqQiQ z*Up%EV`>ziFyvP7ropDOhl;3lLMgp-WhXggw{1}R;)-7&~s%kTP0HQP37v7XvG?$>nH@I423LL#3Z5Qy@bc(jyI1I@%7TGHbv!Y{{y_W;9jG9fmp(wpF@4ERam})}juX#6N`_N=}v#+q(s|&ksE%%efs~>g($)O536a$dU6C z`6kd6^O1-S;A@F`r5{y3Z7eJ84795h;nf266cueb;W3?YqDp(`XcaTyaDyD+3;7T$#FoCYr z0E*7})Q=>>s%=Ped3Sd`OGRnB&z;SGKcs&G*(Lybt`EoAXS&G*@eedNGS{ZZLN1A5 zFwKJ+0SMAJ7);|lPF0CLDJ{K8j{v3slW85Fj>i(1z)p*9!G*O$hRM!d>Kt*p2Na=K zMz8{2{xoxQyIqYK%M`{LXD*X%v-^kHuA+Bk@NL0v^9w=7sQj-lL{O9m8Su*-N|&)8 z^CG)Od=MESt_fH0Eq(L+8u3dI1w>Bfq&sL{2SsW#!vc;8h_HXoV$M-(>0TO zLNdulJ&aVAjeqC62O2>{&hzL}F)f$VOiDYfN=FEs0)Rm(iG{3e6`7bRaaHS6V%O2b zNQ5vM75K)j1dnagelarTfzEw442=%@*0@4+~V9$y(0ICdd}Izo$< zxf4|e^NKBMP&RE)b!^&gdcc|P)0QjeGP4pVZ6$o#lZ)(Qn`x*AQ~_^{nas{z7<)Et zd}{!4iXCvf07eFCW+e=4ypSw;!J6da7S<`qB3_U_;cnI5&jh^^X*=;} zcLo)ylDN*2gEqh}zlkhA3ywBS5x9W^705G{sK?3vl^?Tn(*Ni^N%`(q#L900AC-P6 z)U41F5Tcw+Ssj@vzc>Pftr{H13`@E3r`>}{IK2mHo1d*g+L+LW%_~s$s+1gow}^v4 z2g!7jMBu#B_LTzy6{e~Iqb6C0+eX~d0uw4Fh#NrTdN3vHgDG;;gr;(g3gGiuAad zJx+5hYVX}DF3Yfjx_2e5xUR?lS<{*e;S_=T7U5coPQ`QWd9Ar(YQ5|ei8&Y!n@FI|30TdP@fmo_q<9PD zH01=lDmjgF5&EK`$#Q-^&L1$L%Q14s2;f~K+F}fH!XaX<(+TToLKd!|*=82&wxe3i zNNU3_?7A9e((9US!&=4~7g;g{sLI)Ild3vURalKsVcUO=sEVzmqAFknVj4OPJ3=Ty zn9h6dUFh>wLWBPho&@8rEF~hjf4(H64Vn26lzVPq3dH2DBpLGNL~#*2lE7JY0<4{9 zb=R05@S57=R>^5Uq)i6HD=N0(@Kwj#cpy z(SxT|T?w=fCFqGgPLg}vGBOxb1`Kss$PjsWowl}En5^L`TtDa=?n=&&N1j3kN{^FS zBWU;yIyXMA9GP}}iOmqntF?(>1;~C@9*rUkS{0|%qSi=sJ9Unzr{(@1Uhc!_cpts) zd{(?CDGfu72C)rGD!D}lOgL*Kuo$GX_Nigoo?wedcwYhs4zZfRu^fV0q*2OBd{+DX zu*+htVQc~ioUyh<^}rP7i{#nLu*M%1ic`~3&r(9PZ*TSGv~)qRe&xn#v&YgoS~aPn z`+cw_usu)++)#=oYG=OCT^1PBlA$zlNU0w*(;Kk89^5f$V)>bgYl;)u=aV$KisR9B z@&Jg@CKm#+gu?A0M&~gBVRe&w&IZa}{;N7w9&`k4#Lt1fedACH9gdhAYOE*APr7*i zs9|asM(Yo-(nadv73fOO+{ypK`Sg+2IkeK9QLpuOzSARxEOtZ!5r8l z)30XAe1Gt;LJxw}p(gNOeWU5u<(*@oPZbUx4Kt5(rv_wA6 zB}U*IkxwYF0>y}Y&>62BU@I6EnTiXFq@tkI)mu>zC=)0Mm)r@Czp|=`=Qk+G`Ioc5 ziNztOn>19mq?izrC!!!UZR@qBAhi`UBUSWCDhe8Z6bcg6=t*=4N0yZvq#bi**fUM4 zX?S>6d`+&q4IxPt=Auia6$IfOs&2k594f2E#Kmk_1$) zjkpy~eUX9`v%=h==6fVbbHBJ(T2jk8LC2yYEkg%@=qf%v%JU<#;kgP?c0p*kl#D}< zS?Ypd#kMMah^q~v3i#;bl5}k}2FA)?+JuiWE|cb|%T`@uFiaQ;-?3} zY9e_-J5r$pB)&WY!~`GY4KgO&$)9GM=IjSUH@V=MQ9JUBE#+JrwmHPMmhd5Gqd2ed zARk32#Z52j``&N9nCg#)*IeFAYPS)O;bOdVspB=O3N6G?Ln)D+7Lj-?~8 zfC46+Qa+^)3706T+1 z4L1{43`J_7L61Dd=aMfYeACX)m4PP+b<9B&fM*MWLgOx0>?d%M1_%w}ctX_@x>^pp z#Ua31l~OWzI(^idI(hVCqH3fSIuiPWqz;WgD3029sGCTultTK}TH=edv#m@)6qmDt zb&Umv+gA(hmXG&iaR}(N);=}y(E>|%A1R5(w!34AEszSwS{!bUvXew(hrS@@9ZFl|N4W zG=UzF=Q@@`juod&ndqWmmdXt-b(E~o*5^&@Y1+c+Sm7!&1QLYPsj05>wZ9KN~ZX57`U z)lyS11$k%OPY!OIl48tLWl+Ecl5lNo0b;?(wC(nz7ojm>4a^V4$KEO61lU>~lU5yb zFG^y%1b0GfAr2)C8ia;bf;g8|F8jME`T5|v*hLSVV!aN2!bq-yUb*Noj+xk zw~TQ!$d_>-_BzIkp0lc+IS>)acdD1omU$^%1b+ZtN zw+1GeTB!O~D7x|%7$spz`{FmbgGX;09>4F$NT@6X(@-myWuV#$Q_N(rVjf^RmO&@` zV!Of@xaSC8d~7JC()qB&K`&btW1>)kE`{idZ5;x9MeyMARZFb%Hh_0~mwi_-f*%-G zSfL)qkIHY%vmO?6q`kK6#HE^IVAoQPg%4e~3z5t%LouZb6Z)7ak2QxS;{q$5kQ|GB z!ZUay72k0GhPlV^yVV|+C8W31J~Z1T7=4W}grvbzsvY;NS>k16npDi(3z;%whUt=y zm%I&n!Uoj4X-t}?@r;(V1qp3znXh_MPzKj0|Ud<>my2-b&=47J|d3Tbs& zgcK??WHKkw$S6kH5D9?;^dIpz$UfPb)Efx|)5LX;WH)fV{e36{j_Z=Y6{5na`DOU+ z7MEkWxehzo{mQO;RJ0_;5F}!Fri#0Q;POM4LNryl?bF3N!_K34ls?$&26Nc(@;#2+ z0IhQ&PI8(9JktLX`Oi)NQ)<}H@J*IZ!#hzS0R=aSu8lco0boV0vIxbrlvoVYO2wXN z3Ig*%DO`h)5%I8d$VEUayR}`}|GcBEK^qxZ#dG~d6L(dW6=6)Hx{B=36}H?;X4#fo zSopR=!63vVh*p_>&J34USV^sKCs&Qb|CT7kN@J10D@kSfm9u8y@!9t2$yVC$wyDq4 z?RH|2h`ZD(Z-7Gs3xZ`&xP0Ce0)audZNr_os18f#Q zV+wbf!BzW{D%-?*JapAwCU2NVk=mj1h{u3?Frt2uD@c~T5$7L`aWV?|$=nuAnJ2}#nWE`<8gx{?^>YzD{&v`u6O)(ohIr+fd+@*~ z8MF!0C^NL9^Ho4qA zR+5-JZ^7f}$$m#r?3?64_WK5rjlNl_!SJp|y|~*Zuw8p%TnJ}uSED!NnsX0W z@Y<5ViP03Dl`6(#U|c`&fc5%{m#lY@;8z=}t6O5kP{M2OG##bI2q7kwUtAJq@@Lc! zx-h%g;e**=s-kJ0?3AApkfh>Of;_lYq~htp5amS8t4F%5Yq2AQ20_aspn;ZODA`#1 zRYEk4$*JWf%RH`eld<9^lDsNqZ>KuIGcNmqxIFV6uywMw8#9;y7}W)zP=}E5@~q_S zpIW9wBhaC-ddhkcShT^wjtgw-xRA9FVr-|S>u7Y63;^DRu~&Pap~fZ5hPaL3MfeT| zV+t(wgM^>mk;{dMmMva`FvO6|6GW^_Vufy$4kQuh!yn0NMj1v`p%bXxL0bDFR|y6_ zbkmWS#iEIs7Z0|a2trLXtf(U!ByJb~D9wmg8dd}p8cn4JYhNBE)`Q`Ki{>9xRG290 z3fKmB3pn4WUDTEQnw1tV`TuE|!dR-X>xe{CMmGV!Wse&^=J42rW-2dP1G&TRo|BJ7 z>J|~I#*%z#x}!{jhs2n|2E38WMHv#nN)o|ha~_X_^~sdzWj|W+aBfR6z;qizqocHK zevlG<_vipTv9$2)sY~USTjWAfsPG(O6ZpHJO1Phr>4FbeyXWTc)$~e^yvGs^yQF&O zoMHUN3SYN?!LZ8(q+hD?Pp8I_fP@_0ehP^#0O=%>8WM?vz79^{A>~(*?dmTjjh9H# zwU^3oMOKTDhZFYw=GV3bYb%9NwtZ_|c@k1TEhf~Y&cdOTa^laOWTIl&WoMzi&r^Jd zjEx|Z{AQwvHi(pQ3gi;P#$2|_Un+_KaB+5DT-U5qnCHllG@VvJ96?WDT@F*_{}4 zj!P+#4Och-4-D~5W7rqfL@DoY6J<0hlDX`k#pmY_r#s5Oh~~=U&%zWa|K#mBcgqPt z!1AMn5)ZybJD}v#x9G4IxkG|dB2kc*^WRQ)3@6I@+taP|%$GY-!Xo9}caxsL4y5wy zf5{i1ot;B5c>=#68_!Ag8(}md6~|}_4AY#q0pr!NEn27kWd+nUf5+kD=Y(xc!!n!0 zfIbXvYdmPPU z*gDSk=x|53`5r3f)SN~+v(y0wU!VikRUc~B!WP37_6utIwghq%kCuSIvM)heo`g2f z(n>TZ`K?`AaOonsW)WzUjvu*W z0LH{%w43|oA-{hx+@G=gIrpt>Z(4ra?;p|`d8mxGy|{EPSa$8<`4(4^vQ8jL8FFaZ zZmhAxS`|p`GXgCthlgs6%AD)7j*O^t83#3hjGCJ8gfoJwdFUQj<8-V)fivSBof;f#%cq+qCv8I_PGwG%IMZR~0f3L0qnsR)<&2ax*j z>Esu&1Y!Di4@SnpheSR(Cr@X-!=6gjxZq|-Fa@gD*=E_!YTG@06TjXYJFlJl9{ z`623YjBj3PH#V=}J1P%;HWuk}GFG872j)&w8`ElG^;aA3!ONLB94x>{yq%IB^}A1f zfyR0}P1^%f;O2K{oFqX8;67aG+5SOZ%nV{C78m)mq<#1-_{oKNoKN{xS1vYt9F0<@ zY-0-T%~AOCd{%z4d~5*e=KyKy_wK%KBO-hq3T?6Mt{nEu}6f>su1M%+p6!x!M z+i6u7tz>1k^e&{T6wQ@4?}onN(!8Iu(HE=?KLZ6AY3C3{^HNVWQC znVd>;2aok{ej#mU<>!5M2J%PpG^EK|kq)126_^r#$@h0lpiY&Km3}t5zU(!SC@I&g zE4^hdOH4f>Z>vmL_40plPb;e4XfNKb--?loqI?V~V<;c16NJ*p1geH^nB%ih@G71w zPf;(V1s9zfj4znWFQQ}%v<#(ZFHN)uQ3-6$a{~U@wy`77xNBfcz^O3ufsI^pHIWNK z99~~J8H`hDM~m1v*N5%Z$kWdQvf*I!@t9DyGWgmz_-`(0huLg6VoI(~RdV|hy3p%) zOU6Z`)1&}HyX*^ka0dA<6X$iU>~CUVko>n{KnE2gjxL`W$xwXiHw-(QpYe_R zKJ~@p&)zIv;=080*}}p!dH#$|wwh0}bUv^8pIOrt=Hn|CxW13aeWCtc?7yCbI}556 zTRmO8TDuj_$Y8x-&MliCxV<_&D^OtQw3kA|Pq(y|!ifYw7uDzF$_9&r*bDY01b-8-!p-s@uf22OK{uTcd*uWA5C2{MN1f$fEDaAwmHUfA zdW;rql#Zoc3?y)(@ZM&OIxa{nmRcqKkGgmAmyh`%74Mac2YaK9qwxdSL^yRXM105Q zV&zvxK^rNMn9w6{ZN6XO6|;>!%Swp@^06tm%B%ww8?3AYVJ#CgzlA;M_612D!IYlJ zcG)KI!U7-e=nTvgZ$9+Ymd_pIP+I?iXa`pm;*|uEN`eMAUjVjiq%~-!aAXXVy8P(P z*l(fWU$wuKo?cX`QrR0xY^d{>S<8@qr%0a_qArE81X|lZQgT% z9J)nq@@lLjlb6U_W%3TCK5260_inO*3H$ULW{JN;U;{HOMV4VHGtwR&GAVx!+Wl$G zP-7M|h{}VD)eIdV)dTnk@J1%?ChBE}(|96m7HtQcZ58O_9Ma^1Igd?fu0Qw-Nd!)C z06_*OyO!DKC9q&=BH0EU>s314!3Wpzbpw*2_#bly&p{hK)#WLR$wO$EH^@{i@`&9{R8vt0IC}K&ERw4L zCf*-NRlAyiY8t9l2&#r1SV-q|3x>8k z13Sw(Y-1!uKf<*hg&TyJ=6k45YJFcjyE2ktk!*B@3?#HIMM?Sp3in*WRQ)6?dJ1)^ zm`T|->x+btaRx}GhAA_uqVns$r?Rn@s@}urb?;LM0-Y z2P^XWre={>(gv2s2cZHMiO4z3iGxi-rB|XIT9ckQqKSN)dg!uQ=@kW_s`MJZvW)PE zC6!*KCx~pV(yL}xYXujGF0FsJI{lm;s{xC)U>K+zmI$V#GO(g*7y*ev?zn^H=f|jS zr8_)T>{)Q)`IQ(S%?0oh?N`|c=`DEvaQBHRTS*+%W&piF)^p4o0R0+2$85xrfzMe2 zR1$T>`}t+OKmQthlw2nh{6@ppE|mv)B~)Fr<|SPc(p}n5<8j~uca%=y^x=@I;xo8# zsH1f#}&QQ}8ESy*?Go=qAK&$5oNGB_NlcQG8B;UPNgBBp!(HWLX(FLtfbm(7Mb zHN5zfa@zvnmA5?v00e=cX~zQ&+i{#OCbO$4bIj&GOvQU(bmoo~G!xL-mSsuBNV9#* zkNyPUvBC>1G0EF*SGroi^aVhnGg=vQJKrzV2V@l@nIsjD_>53{EUm#~5ntI=N<)f{pb-3lfh+xHq^80CWK}&9b!x%YFVJ3ms6cQXiLZoeAz|&tJDe zFBe|M*e3EbhSQ=x=~<^PXMRGA#Q~6}bQ5Txz^Q??igWO)38P5?hjiZ&s+?)Nzrv!Z4)}CYu0kdq@qxh1aZJ1furnnk^}5iTk!a_luVi;CCNt_ z5RBeoQYtEn`_whHi7FXgIF(JtVN$OX}gC zNSaM2dyA~Y6>N;I)+^Bhuf*^T34j0wx{?^}IT8mWFu^AD9L|RR>SOSXZ;G|^7uJU* z)M7K8Pgmu}q-nJGUuDmyY;7&!J7_2s;}HyC$Vkfc5}3s!FVF8xts|rWM%ake*n=&& zNm~F)#q@*2Rd-N!Y&!24R_ea32RkCquQJPRbXqrj$YVwzBvKxOgpZuS>3!o(nj z4u~CHla6ctYD-?mxAm}jdpH`zs|b#<}>akbdvYAlOQGpkOaKKr%yeQF9#{;nMj zngZ<3J$P+EWIKb=6cMYM(wK%s%9hghZSl0LDdP3mNSn#PH@0gAR&B{kthyXFb~Xq!#vamT9R&FMS&r73v-)5EmM%+} zR3}?#Cw&(~zAVh;LFG@4ed1RdqZRVxOSSETV-=ja1(_6dh*tSoxx^%HTx9XwLl8Hx zJgmf!S}%l?xCyeR9*TV-y|2K>s z%37-~ZWkz9Y6$z)bYIh$tg+M)!Cwt}OC1_75kn9Aw3s{Ukz~OM|!B%d;{Y6p^)Vp7uoJ@=}4u+_5Alw@j?+0&p^$ggjME4W*XTl9kVZW%KEnEJ-`GFAqy4 zwMJ(+V6m!NA{7LMHO;@IagHA{A!da2+^~~4>;*Qn{Q4=%!Crp(xt`~|q!r>#9MB5i zTJ}OYuj8vZ?G+z{pGXi}9p_~aa+WJIUUr#NPv4v9N^k(gU8?Q6U@*m& zmRjYf{d|>LWfuM5UKfh`qvIS+x^E1suB&xl{No5S)LWQV&78uPktP!oySKf3;0$_# zI<7Tf^1qGEl)wL#D8Fbqi=szyLr&(vOGSTF)*vIrD260c<3nbqSpRjW(6LyTW@BGO z^%^_M$LBbblv~;cBAHF}*cG&EYC9C+VEZj>b}v|F34#kC3hgEvc|r@4zq&PShZ&*& zyG$W_TMHlyIV%6?ZKWlqvfquMIfpgDq6I8P`^=&}kUzjitP=;o3sel; zH)uoEMNJU}o~JRLP!@?D=@R_ql~!K)YFI~jmxs0rg>X;@PkuXGEzAX! z+S@_r%4DQ-b98~aVL4e64Rru^<0N#U1>WH`Je&E#0Zd<=D|(lhfJ|9rmPnZz*d#2G z^8bn!9>8)p^CEL)Qmc%~pgfL9{sK|B+*eatCAr7pUX$5g`DxSoT&ot%>cJJ=vj92G z-`>UJXzo+(Nimua)UC|S$cY9(iRLaob#j&}D)*IV};M_{;NUuQ`cCT)*eQhgN zP;~$Tg%{<$=CE?XVoWVTJpT_I|DeoV^nsCU*9I^;pdH}5h`~E5T9I1Saf#B+-tj-M zt}Y|w-n3OcaMeo7DqE_y`L(c?4vyaE6bEVuyB`;Wr6N7Kd;eF&k3ijxW&iprLl$kV zh~F|6kitz=91R(igUPnes1flT%Q|Zqv;~=_cJdqyNgU3-naDWzUvR*nOBy_7mVRxu zpgjS~9nl3UvUs5aGZ=qkPHlHQ(^R@6|0uj=>2%xKKQ5WB&$2v)Q}^u9_LkUhtyW3q z2il5x(o`|W_&^c11s=bEn688~vVyuBjW{Lq0gOssNWCF6MGL0}V+*GPvs+P1x z`b+zZXf}Js=tUbXTu$>IZzFJ03=ZHC4xW|g&|1D^|JX=6Q4#&=d$QepNRPWGM%|md zwurCc^SGD!=dAxejl0$gpUB&Zu8MWfu8}{B61nZ%@7QT;~ znt#q|Fl6DHJ`TrayS&*uDgIifmq=$DtvN$gu>nVF)XLJ#Bc;hoCkQSwT&W71@+iwz zRZu`h&<~g%64&zfSO=nCRsp(bkq%2zDVAIJ&Z2YYvxgZ)mhVIteEhYjE{A6%^0-%I z)Yf2Bld6f-zH>OO`{Z=m{h38nnz`~XjC5dC3(z+)o?ZW!wKoBXs%qoL&mBNnRM6Da z7B7~G3p%Kk89Fl{8iq)Mwpfh=3@`~ZI5W6ZzTFv689=}#_pL0q+{!X73|p+;R?9Y9 zZSQ?6uzlC>_ndR@oeSz)|L^->J#)|RZ1*hBdCv1Z=iH0jMeC!JA2I&*ZndAx-S0)U zwPT=!H2+@ugq_x#7P%7_B`^uUyaeBz#{mX4YVS;A0fe*y%-u=X!TA*aq3WoFFYy^n z>NgmjxE~!LM-RqV0_iuJ|MuFn5v37F!fU&fn+$+L>WEy85Hy>ft9{m9tAqAg`^ZCl z36be8<7^4KRITL+eu6d9AWrpT^jUjQ9SBmJ#hkK0NBT*~$a6|^7Z4f8XcH=%)34T9 zIt^N6riL+AaDmLuU78`Gue;ya%^B>iwr z1jt#a@!*HzPcaH+LroQbiV-U|@s$XY8*sh|Cpk@9ZI|1gk4*Rmtb_Py!b4lr5e|0~|MBJ)}i5b|j7lo{pad+3-|H zI%7)r396WZ+MaB_i^~{VU!#k+(DpKaq-alNGXhMuhoUD%q8ITtzbxIECfW9Z0nOaC z5RZ_m?@YteHNUbsN`|ntIV!?*C%!XD%D9;PstxV%sndU)R#(|mr|+P@wL_;$$U=6f zXleL#mQ8}ngV~Qih!#tW9CnNO3#9mT6Es^n`cbd}yoVvaI;|>DH_`d}Xp+J}>T=w~ z3+R^|440AE;ztIs3NisBbeA|?!8s2d_#(Cgg$*-@KHAG|({w;UJ+q5-+EYnC z!TbTo(5G_y5y5mIw$!f!4Fn&tGe-@Lp^pO56xC_lVK@Non1v1?l_?fZk~>v4^KE7< zd|3MK2VXl^!55J5d9K(S)b9zYg;r6aR0S&ZzW-ioc)K z4|~S#U&XvfQvc`_j)3!3DUyp){Ci30H9iE|pElvOJHaq#P$U#{71NnS@htHNF+m$5 zO8*{2+Yg*zEy4^C2JRQc-=3mBlnE(LygV7MBW;g#h-;J>UtBrI5Y)zNM5KeiEXA#M zyef1A1^wOr{0Qoc8YL`^;94Y!{K#lBbOkYi3@XgF{#$erOf68~+7*KU^^bU?s|Sgm zRZ0KM?!n`1Xb%0&y2PWGmi{(mC9=?1Fa?no_foxS%)m;%*qA2|P7ya766ZyADklLnx zi$v-Y&2U9UMM)4ZOwZ5&8CNS<{PhJW)^;cwZ@tP<&HXxQi|h&hrcb9c-t;lqAPB>3 zZDXigtnGVbjKFs-)tLq++EMf{7O3bdB-j^CE0JkFW(>aQi0_A)$ha-p=HRah5XqPl zR^zR56AZB^8S{Xa zlkT^Xa!h|=84Zu5tdOx{`ROK-5cDHV-(X?lLl#YTZltG5iEp@(K8w8Epe;V(3<@Mm z5WWUPmY|q8yZGa07+D%>!_-!11cK@NV)T6#{EZToG2suc(KDjxZ;fdx9%o9RB=k}w z<{gd+qJcf*ivAxb3yS*jA55282vBYRlp=p~E@22CmN3KYpkgkR^C_k?Oi_2zcWqt# z341$obG3mh63YTd(YZI+LOTY9UIJl6#jS-}YTN;*zNJp&UECoNY(e~^9_9R&zGWmP zH~)LOlKQ0;ZUi@e9|(g-2E?d@XCsXrFQy&o8(^&5Vu-G9CQ%S$fQk7c$W-0img0Ia zgi=i)ZO~s!g2MT7MBFr0s006~jne8OrU7iPXt~CE&52kyU=bv{A4za?Nnk>eINpdS zwVK4=WWf`Lz|jGM;O-tUfkk`e&OPQ!9UX_Jy%ev|7sUsJvy% znw6>Xq2Eexc%;?xXX{@}`#e&g`pX3G;H5k9ymiCM$2>7M_1@Qx4gY3yt0m6e7#bOI zThj%{PVFgL+iK}@XxN}B)9!A%ZhE()(y~^|)cG|WE2QT^e zlBN^M+jp-Cwp#W~z4-A5J~l zx1s63i|a=Hc3Z2ZIrltEU8pv-;ziHb(+gTHmwnxJ_PXOMn%=lMvg*Y2R?CcGqsRX8 z&6?C52TM{G<+WPYk6QR*@XLm#i;n-~HjCXQ)p zJpS&{yLz=+9**tg4PIHB8W-`|mId8fEe$We5?b2bojPsU*zJ2dwOaN+uy<0$q{`GD zkEX<)>dAYO!3fCbM|$kUN`JZp%6T(`zl3t~;Na@ohnR zYI4XiBl?vVOKV|=t7D2*q+ZW1`quVBi)CKKJ@0<}k~{Ti>XVP$`)rHF+%4Wxe|lN! zhsWMNIq2yY%icY=KmJPN?9>5+u6Xm^<`&DG6M0`Bx@cKy=MVl`{ZJFyvw0R9xxAri z>yY)cA3E4#$=tl`{g*ym)Rb2A>b>voZ?V`%#UFb1!?{ht$?K;Lez?W*^UZgBGrrrx zrue0|yl~%x$p7|Vy`nB(miq31N3NK#r^OPrwr1F)tL{ks>$#P0blcTpiOIY0laC7; zQwQc<^FhZ4S}gy4ws+2g=SHSJI{wC*%eJ>zE1AoQ?E(f)x)#3#jY8HSpMCJ-`&%sACbeFDWJF!lf~lkT{_DOL%kKXS4$aN2YLcIRY2^6LEtVT@m^Sx= zSC%#P?>99#>fRPhVefw_I})x>^=;33W9mIEmZW~SHn;9u*7Wk#cNJ~e)M5!99Jy#$ zx7(VU-;Jy22Hdi}>_BUALDR54&eVrCwpgyKK9M)(eWj^t`E|d|2Yz+zP5&zFJGaSi z|K_U-;Jx!}4^M1a*yIn~f6W@;nlGkaJiPb9rhgZwP5T=7*c&mozPPS2)pE;+lU*qP zqWdQue1G^IO^c+jece%?nTLz>{`zKl>hLGc(zn1egp$-T<_BAY96R)^3Z7oYAuy6RS?Y1ea?jPHZ~a$oO#C+Cgj zP2VmZxAyq977MHCGQD_LW9sUnn&Z#yXt6x}-;+-cdvtN?dz%KOeZI5Ba{9|7>t^hC zHr0)Lq~~yq*EstRH&*_9N9q-GdaT}!@vIzk@z%aE%bK1&y(Dfr#(Ut!rL_mP-_rE? zk(c*g`Dlyf#)FM_{&q=eQ~Z?YUmW*Xi)F`eKlV#cU)q$D{o%&op%%-v^+j)&zObO_ zv5qg4e|NaWGT@aZga6z!E4A_D=HQZNS}c$IVn4q8^|I7UF8Q=~!SgMaf`0k^B9AO; za(;fx9Yrs-Sl&$e5m?h58V4hi^cl$mN8xKYit^Q zg!Kl z+juef&CXRzfB)mqlBSr8-=6*y_|d*jd(6AtzSMP77JRU_H~8US8*d)|X?^PLM^D=y zkdgkznAaLkRHa_~+Vw-f8_;Sg?vp)g&&vg=k9^r-dD*a5OG)pgr9);Gr@9(j-hwOO?H9l&0UGzGZ40_^apl)0SIyH8kBB>NqiZLaQZnd&Q{Tog16J4|R@SG`ZEX zwd0sA3pV>x7v1;A`@L>xwZ!+c${Ushn^sl+yXU7f@cgAuzL|4Ved>bY??rs!YPDQD zQ`&js=&IBi4@*BJ`dTf0$3EOK@y%e9eeE41R^Hia`FH0DS05Y{Y8rUYPu<5aY_%M# z9z7#+zd!Y7OYN6K8(S^2yz8&~=165~W!7_lT(_pxa&pPBhHk$!G`-t+-@SY81ONA5 z^2w^*i<`bHu1~&ZPpc(b-eGHcx;}NlO^%ie9&5D>|9bn=%LiAbu6%6fm4lD8T3Qyo zma@IDCe@nZo<1Av?YEy^{n=wz);D#3V%@I4-otwI@{&nchvuZd)3_n<}&nUv`=7@yd7J$qM|pvvRLz?!3`5ZYb72Po~7>UZ)QQ%PzO<$5Whsd5+WTl)X-W zh1cyYl=CT>TXxR%JKa84eyNkP&z;A-&e@)sh!-e_hdBxh?ONfCM~s%$I{8qr9_9AP zz<#G!E<)w>;MtDS3a4D+@ZpK!&;n0IX(6v_p|jNK=g;TW*Pc*VQC{jQa2R7I=GwcOI*7&vbj{xaA7Biw06IcDkKjM=5&F?<}SS z6GVVLT?=r|b|To}hAS^GoyP|B_YII;J`9?pFxlfqh;weav%v3i7gH$(B}4r;NW&gZ#jJTS>SuBX}tg&ce zvZp9H-&5f(JbQkXE(%a*jGPt z?(=#o%G2htvgEOaMLxU3UEuWjJzl%0aq1XZjo_Hw=CdQK-Qo9?i4;tGE^n}?8pBZA zkRnq&K9hQep=S%T96o;-37?i9gW>V|W#2rv-!V5_s?X;tcGINRV#*MUv}rECZxXzi znFVyexuU;$WH_IvoTvn|xL{2G3R$2r=DGdN!{@T(!Qcw!8_e*TZy0R80sdt3+`;C# zGJ;A$vN9%J83+O0z^4=_!ZU})w1{S-zr^dA!}5#l<+y<+QCC3$9uQm+Qi5t61v6zG zVszDrvI?JH&Ic<(i71cr9=8)E_@=pV8|UylxX0_5!_r*E<4Zjbe};QD^B1~ivm*L& z(oX^X^sitAr4FADGZA+$$PAN{7|8&?41#w$h$Lkn$hXv)j2ii!ycaQr{a{n9sKO1> z2mSuvWiNHk1ve@EzswzGMjFeO-HtLRu{2a(?QNP$C77>Tjl-GB(cCgHIgHNV=5m!0 zSq(*U2QM9q1qGn@+m{cb9q)BI)71`|n5+3f^JR{5y9*B_lCZm}|M)~87Gw-@fO-os zL9}qJ8kn*o!&GD=c7rE7G2Ox0Cgx7gMlH%K{LJqsniln%?eMxBw1jYmRp?Q>1s(45 zgWO%Si4};UFLF7-_0N{hk4elx9opnUO~OlytkEIp2StK!$YaLH9B8wY=-W5T>&G1g zBD_A-kMUYE-l?o09|7QyWw}@sQIMlhc-r%7UxC+E?q|8;Rx+>L1NuW(+i!PzJ$A3N z2&+Z$rPSVc^IrYeJR55bZOa^L!#s9xPLAIDk<+*beye z8HtItt3_gYE7wY&XUKq|EmOlw9r?~udF&Y3OtOMNsj@G5Ecb>Jr5Mws$Y&%$Q`E%N z={&l?Q4S%(84ezPws2pGqg+b^(xcgHFE1EQ+)B+U)=7JX&snI2&`c^&ftE@1Y=J02 z0F48Co!}aN%r_bgW1!!~IfaNQ!u-%<`BGf&0SCl@ddkwlb8|S-vX@Ylwu*V&;E;aV z?~(Ie#T1e6f$&9Qmcw1>)2UL8)JPpux5R_#>H}w>wR;|<9xjcsQfCoF1h4FM6_=ca zy0v7qM7Vs!>omI8Vw{j@3Y}A@WTtyS(Qd3V4AkB}sN#&7Ti_`pW~z6C51btGgU)5! zw>aC8P4(178|neD_sp|)jT*r@p_Xc#hx0CyfaDT5&Vcg85O10SUK9Al|KfeovtehA>-LQQ#E*3b(Js zRpjSGz>{QQEcE{H6cs^q)nWcTzjLw(g7A>%Ds$eB&Q?P(mY&ktB!uZpk~Yp%1}5hj zvL}TTqq5&tQC4mj0=Yq$Qv);-EClQGRuo{8(L>b8vlWZFvFn|VnYp-Q(Gj^wmZ4?A z24;}U%VC&e#AsXvem2EfREl0i*AR<>G=SyHE!$`r5b`LA5Q2ZTrwNRq8lhD*pQeEf zGF8LXi6IX_W&Iu!D+hq|RjmZmL4BH5in=@rA{UwoRYr{#^aKgRsfA4P6jorB;Zqm{ zUG5^01hs-tn_MR1+T>LMRxQqtF}lvV4mA3#vm0`dL+uZm>;i(cxk!VR0+cGeMWrGg z7zGB$1L>TY5cNM~a@z?fIC?P$I6Se6mdI zjgZrQ5Tzh6VfFG?_|%nHEUU<-_JyWCILgqT3J=n04C;)vSfgLQWc!%k(LhdczSg3nzvNNBle^K2K?CC+IfI=jj$ z%5otTxQZaYx&7m4+Jmuz?$pTfUW_StrHIj|aJYPuQ;1VySpB@OND^masa8qLr)Sg2 z)lmSo!begQ)>?2SzHX8D3b8hMEHMbIQ-#i<`4vUejnNRYeYeo+JvpasHZUMvk`t6E zWFlrK1tpyq4L)&=r^4$aZAW+z0<}jE4Er7a5~tVhnC)<3MK5*gY7ozB(1pi2g)rkm zsrtC`iHe!-V-@9vm|=p2Po{N^hmxE>g|j)QF`KI_A4~-43*}iA7z~UF#j6@Fw-KPX z(6?Rz~}4HavJ)6S(XAF<{Pv^@`60*P}}hE93l`dr*ZnP4%72(Poa0{W5+ zI!19^ED#A$QiT%*IsKDd?g|LdL^hgN5RQfr0n*WsP6w(eN4$m0YweqnP1*`8hVVtg zZ^1k;9gHc=K~6l|uF3sAtR}Q1It?NEBOuU0a11BaBMM4AK8TTqDB|gu%bKkT9gcd1 zdmoYx&B7e9pinG^(MxxdAL0ShIf{-dVT!7{kc{L=mX~^Y=091e;%-4yljfo0XWc`N@LbH?l^IFQdp$NLk zxFGAo2P+zB>R7J|F%h+?EMl-ckjKbtu;$G1cne2UIBY^7JFEj|iYR!@S-A%CfGxl_ zdFI@OE)C@lbr9=`E`fOP1c#S6u87cPjWK~(-HjpK+9PMGLIKM~vvn}ZQ62_UoW&V) z%jH}?f5O2=Q6`xvA~_dAO*md%U$Fkbz=>}1R=C}?gzL($5QYr6tyIK>p+|Oly=WlH zhSev7`)NuGA7ojl7xp-TY{kWxyI_|Bl1)qarVweWUS|>PvM^x@2+3Y}Ab;Q~q`DM% zO5uZ*tAq!5Nr)H^FW7-94r3a5J@g#8+~Gn}qm4rbyTnQ%mp~7p#nwT#+2sB{8ReJD z=o1)UN*pjYL+~PdrV!D+Y=FM>!vtA~vE;m-h=BKV*y3T7C5#1}xz6h)a`Q0g4SmHq zDEH}n5EBRyIuz+3J(p5wnF|b%ByW!w8Uos@+ErM;u#DTUeHFE}L71;p4TGNCR?rR? zrq!JUI4~qU*Pu~_1J5Q-pZKWLh}Ol#v&KT-Me}JrOtHIsuuTZd zA#4g1Hrx=V32>Oxn$j%9iqT>`bi*@qff4g!;LCLskp@TxX{;ikQO#uO)QnCh)*ntWW`cXv8w=rBe#B$iexV+!=qKDwH$p?&PeOR zD!|oUx`(;nfI9}LM00aFLs2Q^4Ay30KEW;*S?qW~p)+mXO$1b9A1j1nrEVO7^k`p< z7DjLwD9g^$BAO1K(h5>7Seu<4S??Z*WX=MSLX+Mobs{z(xPXN99KBTFEa!zJ3cc*C zaq5cPM#7ng;O-7E{(g9sv@>sxT%ak5`-`e;+oF3bj;l>xnVQ5izab#u!0-(dE-S@sSDIVt>tG#Xk1K4G1PfR(Ip(JrV|

bfzB%jaFs)i0(O1*;r1M%vQk z8`R-V9J1nYqNm6bFkV*R@)q#!1*HqqkQ#yN@SQQFp=v-yQFj4Y;=JUsv>kv|V!YRL zyOSm>mr+7@*h;<4Z5CYD7vH#xGO!B*jcHO9@-)H@U=kd<3s zudoh+y@Q-+! z?)D}+>L}_kP1+9+t;XneYo4BTl4ip*nD3|vm4q-Rn#MOz*s~xd@n@(BxQu`Y@uLE5 zQ)E*)kQ31;=N#kWPeV*o$A_LTW#O%5BA;T|^V>v|eG5y2--cTmZL*UGHoj6vfs?!i zPFJaFH4$1p6T~;&VE5tLJ|q6ev?->F8S0EN1`Fw;eT0w<N}H z7b8|}F2#|WqAtE|FvPkdV*t?-Y5XMlX?cqL9!EF;^qcF{k7AH8$I~HrLK~fu8x!;zrCmk76k0>L6ZSH%TSGfgnUl? z2>F=hL*|*Ot%7_7q`eS+R6$pQ_!@-d%ho=q+!h9Neo#4KcP7q&cUKGHCHaRbxN zaNv%vht$V}`GBT*smEQcTG#lr=U7BT;#8x#Aq1Lads+(%^P&gZEFxkTT#XQ{Uj^Fm z>B^zZX^L-{t4aKxTyC)dQPQS{4zkEV=4=y08&2)w&l04km@p|%^-s*z12c0c>wZv~ z>L>0+t!^*C(QKgb@J5_Ch5(y6Y-Whi8rUuv#K;9^u+VZ)D5V5FVP28;AjXwj7f6X4 zP&|NJHkqdg#T7v)FDfEJP6BHgW%myx+$J#P3N5q*LKvALF}29Yt&uP((oQ@hL8A=x zg(VlO0uDaRblSxv=h39{`uQZ~P@Dn_ZIXxztD=mP70^h~ zh+~FgGmg&LP-|(JaN~N^Y$xbG2Z9W^EBvUWy_EMSCRp2Za@1~qj8Q}*w_n>m(gaOm zu+l|;kx-*hNGY_xP~pVJ3h_vEQ=Vs<8ZfKE<9CukNk$ka6V!nE(`hv(RB&v#7L$++ z;~K<2lEi6;ga)1FD2+D13r4O5VTN&Urh2B01KMc7wjqf}^h-up2siC^A7FiR7nVW} z719+w(ou@!LS+)?g5|M<|&=oVuB*T;HZUyKzaB%$(P4!ZEl+<%w_Gg z+2Qxt?d?j{^0l|_VJuJ?Qd`xqaTk`3^G zCTc(UXKWr&YsAEX;fYE&98PV!lW$Drbr(*e)U*qi4)b+-n~Gr;xZK0|?gvi8(ejr} z=3u?%hC`rqUM`tZ;8-wHpt?BE1@>Oy#cco`wjDq+0i93|(?6X^!Wjdc#|cjvvZi4O zai|JU7j`P_=3}YD<`@|%D6K|+Q}f0rkCHXhUD$G^QxWsQ0EcRj9S)Vk;*6Sc0|Dzl zc<3O$s%i4W0B)!pAgg+vQJomT?Udmtn7LH}7t&M#wrp7uI+gM1Pu12B)~ezUKh~`p zXf(#@nxIgHy`;jMsfX9LjIO+U{zS>|;VMhk*J|!?% z@d}|do+FAsIhMg?0;yC76lE5gd<|7+i2J+*` zFx_zEBV3kHxp~X5%U+5YT~)Ccl(>LZ5m;4G)P>Z}7d>s^(0P`&%o;XU4Z=q%KXW%$ zUyMZ={e5J_B9>*C2C#+AbrwP#9MA9S(xy}K8Eme-$OERsl?jXy)+6l!pd)eY8;#;h z9z8W2C^m$24jPWos1Dme>N-Y}EOFX!8mP$pL^(zY3#YfD9Q>3e3Ns5;hTan@WN56~ z7EMZLV$TnK!B5F>$^FcuL9|S%QM&Oc97YTt!kwOmco&^tAj3vDunkkygWIl2dN8CP zM>sF!6Cr5|PRWf)eD4Ueoz7ySWk^C|ryJx-~jP1+)PQTVT&fb#^msI2k{nq}z4E;ZrrcI)s@s-wOZ@YbOy^ z^E=aar-{n6u&@lvNnQ))QswlSK9}!$>;sJF+pFj{1Axsp7s49OlhPQR zW0;C6O3Av6G^&`PzZV0AG8eW*#3YjD4x=D;{z?csU~|K3N+5&+!rTfacBE-O>EZNH zdhf}O8NgSSLONxI)x>-ye$6B4XLunwR^ERwPyzo19!7!q8HB*0BYd*>L72?LM)wc1 zDY0IFR{0xOGGcrM)Lir*tR{5w9y<*naBwe1mQD;2ey|$QY{dRNDrfgP3SDz)c_LT1nMDi|=_tG}GgWjItzI?{_&3OR#t&v!*ch0jS#%I++_@#?9znVgs!6%w zyqF=G>Jl6dRK+L+aDpFA#La((_BW3xyopW89(NPVnVg%MmpLuNo|!#9GdnZyMwXp1 z!PYjU9C{v|sI}wpjIfobXW4RL4Vp5=cB8Q9li?ipvmBh$&CRo=Uu)0G$hJ?i-9QhS z%982P{3nkr31mgWxa9i1Q}SSOBv}}Fr(_^=`sAtEJk2y)*3=C9gp53Uo^3*sYLD;_ zRG*J9R5*{N-I$k=YtPA;V$aCRn3RDKy^*}7GOW4u#I~jRz(oowyxhuREOBz$#EkSj z#$RoqH+fQsUIj{(voa^8*~ev0$jr-yMv3=~Afl+XnP!_}&zX`r&6by8&&|lo%b3E@ zbbGFCJaubc#smt;%x)Xt@J$6P$cDislWr~_-V&i#0O<@Tz2XawMj?I=nY~#?PHtuv z?idP)Ls+rxL=@`tC#2g^b$i~8IT>W66V1T;%<|u+9zQiZJuh=|ww*dMee$@Bf0WCX zdt-LGUCT>DoXxUr+3owjf59Y{Gl|(IsU+eTTP@jBv$ANnhs(TnU#Z9Mo6h~W4CQtb zFcxr6Y8p>zOy)X!l5#I+7ouQwY<=a#LDV4KTjovC{rVsx9Vd|~_Uy@1CfTxBe)3pO zaE2kK#%j^}YeNtbh<0(zkmY1Tg8~15XorgDOwF@r37X5Ed~HTX4t4AQinou;$jQ5g zdWD;6)NvL4JRu`HV+uB>rqIj+g=O53kv=sqGkXFnOA+ZI?TcwSY4W(KS)f6rn~MEF zssX0*->1yV%)XYA(HcellQtgooRLmEfrs%^X3L^JBH8%tX++al*5nDpGw3(Pobk`P z%XYmD3@&?ueM&~&)G66~B>qV^r%#@gla-N|F^+coX;jY9%Tu$d_cF#&!T&quKTQ`N zH#?_*zb{$ML3RD7B*6>)r-=>q_(xg(z9K5c{exN5oC$sn&6Y^!_F9e$03t8LQ_a`E-IMqPoa3eKU6?%M7b%@ z8_LU4R2i7dB0_dfVWn6opwf7W?I))&_be{0w0&R-$qIB(-RT_)Glh5$m@@DPzI}PF z_;AH}a;hP{vBLA1`KeGdx+ul0jx{AR)6>F_87rH)kc5!4JcMGwD%Cx1RYQc)7g`P0 zR4G^4F6^7{_uYEw%|izb#%FV;-*U(NJBP8HX5EJ{h)xLrDT3`K$sH6H+uwm z3}lJ=W_YF#I$W`{5c4&OpDaKm)t-*>)1*l%AIOr3?+#?7AJJ%dijoGwkTDSNC5cZH z;qf?Z%oQw*uwB#ck}#t*wQC^sfc9^Z!a5o5KRRe9CvmeN`i1Nd_+m-8(`f6Qwl9(p zsae#}fvA*r5QrOj_>my23~~~EIECjYQ@{Gn9}$Z_=WkrVI195#;n|b&Im=tyKAF}! z^(_SbGbyNiIUYHLf3gKn7A0sOQ8{}oS;F`ySK3Ewwrf?lY*%y})tab@TAE}TjqU0;KqPO(g6ryiYqKxp% zkKzHkomAGWqhep2SKdei;rio^5_M}wXGLVOrtW}U-RT{`2G9`}br%W^EeDI>wS)DN z?8oAzC^~>HQqq1%co<~0x}a?|RSYKQgKdVhe*ujXofE-XM}F9kUSA=u+qR_ehkh_( z{9H$y{XJgmL4yXI(GrbTjSubLpItr7GTM6Cn8BA0xrB}BM}m(`GLOurt6Wta4GFUx zY}=rVWo{`Q0s|>oNx9J!=2KZs%tqt8viikh>7#5cR{Mqk?FjgMPG2nRpFG?QbL%MX zVv(i)<%ReeKGcjt5fA@}3LH^Kx(fJth_JHaiznR3$k#b^llBUCxJ+yzwE=hx58^zW z4z)}pd&_9_u{b&<)|Rtmk-;ggMS13 zS{WOdt?4n8dygR=&w2x4yCUvIU>)3IIP%xSHK_hZ+?S~SrMNGH+YG0rxexy3aCgJq z54Qr2t}SpYxsS1}2LCqrsd1~}wj2CA4E_fU{+$N@E`xu!!N14g-)rzcXz)K|@b5GD zABJD+)JF{d{qR$V)AcBvmgWHb)cMrukHJxgQ%65;@HZL!hYbEF;NJ+h39i}TKMX$& z4E6n!2LDs=Q(sdbKMhCyyM@^rpOE6Dt<1Iw_s-OxbWvaKV78Yi?g3_dhvKO3sL!ac z_AuK?ge~uW;V8xwiLq1N7>mZeC#cVi1kwn`5^z71%GeFK)8J8OQYTX9QKwO7Q72L7 zP^VC5B$P9D6i%6iJ6wVn<-v7|i;Bcwq+~~s<{%t(*0XTbQPe@t8T`+~uMyP0;ipcc z&U(S%9|k{l+F`gC;k5KG!B3q=okiE2evEB{+XpujZUfv?Z~?dmIKx{_Si8i>1n3PC zesF<)xXR067S15*9yORg1*5&0sDEgH-e5HD%Idq?;mtj6FZb~p;)C_3hzL^z2mJjb zCJumNFAir?ikOp5gNm(NQc&^k5yz4U^G6aTSR^K%V&i-pa> z@dKR0!RzAu_y*c5j&CsaY&{8#C`^2FNqi^Jk8e% zt{?A&c%*GpBRSPmduL26OzQa^d}DyVCW1i}Z$xXas%i=;eI*Aw&~(}mH!n-2+QLi* z^1v^s1HVX1b^-Wkl*Wcnuru*R6%-CD4u0t~exg!2;w&P}80wct`CETzF6co0_!b{# z>IZ5b(u*^`IQ@>68ey9=kr3wFeQE{TqDs5!Gv~Ff0{_nE*}p@9w{@?jnME7pg>)7e zUvu({VZ#86BVppZDC#Rd+8I0gHYFy9`au~!e}>XNFuqqpl+990a9mhD>x*8~PQ8fZ zIS3F02(?O_hS9@?rpqOCdL7n9Lm*D)uuJsr!puXH=`aZ>)9+w|)X6r84PukT*;Cqe z)=miF&cDl5E_SSm5cQAp3IP?<3tR2{2n2oHME#%%H})g5!{>3UuQ>6K%)sUWTGCA) z>Ri*_lN3rOPDN;6nc^=G@!dmyfPTDs+=l6&CeuT3iX+pl?Q1h}>d1J!f}Qz| z0B#IUFLjjZpO%FQWR$2Sj}u-5rd$yY)%*w^F+3cs`5_P@=8BOb21wX_1ys$d2B0NG z^TdZ!MSgmRjVIPU^bu7Aj#FQ3n@q>hu!ElqzM}bkc-N|&Q3!nlPJ20?F#O@~o**C$ zcvZqsj7J!&r?=V%>)p>VYeA3r6O_bKA*Kl<3{!9)gnsEv;4pBtKOU(Cd z!N}DVuo^(dp*(t!g9bvMI%+!Y@D!1ct?`%?cZ9@27R99Qa6MFaKJMpB?Ck$cOp1zN zQmllG_{%p;ia>}22jNCCMFMva{s{OZQBnlLBjJyNpZ;7q`64~IKM=x{pKug4<|;!*#e+(CRtyWm()eGJq#Q(a;u)+g2^_2GB&tF9w6 z_10VzGo4R;gg-^6J5vPy@)i$M+lz5BMIub=dm3ZzC|`Rg;xH^7xszDOHfca7G!~*i zsn7m@c2pl@nW!`RES4PgQ%5GD?Qjy~_c&&{Ky!9(F+ZEfY$x86;(qEH zwj(?83m^j(m$+`5Sz6}yl+VJ8MisN?%$;|8XQ-Sb88lK{gW+H?ft17;DSQ3N4{#^$ zm%-f%mkQ++`@V2v*_biF2!pL3!d@{Oi~^ETz`qbim-}))@ZA3_e*bf^U=pNw()A_s zqf;0upLAVn21XB%0!mlfm4r}LRi-EMKWQljwfb_ z`q8Ai4Q}*kfiY>g;@fmyIGz;V^~1yMA*J`=gmC(ofk&#C%6kQ_p8>xLoNmBJfsc<5 z=YI|OD`4u6*WsrtQ++=EurE6XoQwR#{Ju!!(X2WX`JAE0cX59gL_!#IjlGAP z3*%3V!}}D5>)VuY`VW9xK@SlOTpZ~?1ilA`5G_C9lYI%JfolA3)L$_ooc@%U)*oLE zKw?}kjidCKc1Tb4KP-oFxV|DjTwf%{|8RY!cJ&qM!}S&E_4=Yd)DEhTRzD4k`Xd3d zP-=?jDJau|ANySaZ<)kAbop!9yo-?gMkq<_A%TEjUM3t1nx)7S58mx ze+s9y?-b~at`#ajq4s?SJh*pwd;Q zyzEQ3_Vw55GkqYXU@UGzIQ>_^TK`e~{sTNZiQ)zQ5I(;vVex#z#`OPfm!7aOJz?$n zlluV}@Hn+T_L1TGe2sX)ufRl5pKpLm)cOLlZ{d25p!Dc5HU1~!Z!sdA=sA|hU!uov z;rtJcP}4ulaW@@*!7(za@%uQ&AglNo$M{ik9_Wt7i>?;9p`*f>>i-qzC+JP2Zw3BS zV4k1w`2*DSYWy0k9}!H{kK*@moS>&Kn z`Q!qBwr4i9d?;NlQd|aF&CoJNcl1b```N;fgvF`pK*0>FD4gvC%KAy7ljL;K!9H>4 zH+GY_v5avPpKv-Om+o(zO6M4Nj#r(U#4+w1-+U^EW868GPhFoO%D|_z&5&oay)~;K>VdFjbZr;6T@1{+_qxhJL zKK})Hgvuj{hyMyk;}M0%pOoVEM;isC-w4gA7*p@-*VS!Ndi~fdgs^X=b*q{@t zIGguZw2t%nc*W@W9X=kheEedNXBp2Qr^mZFL+PaBUsLG$opmg8`st$QpUj^ZugBlU zpO>KH*LnPTIu-(GcRhdi@l<{f9S`I5Bj}6jw}wCOd_Df?SV}MGmEtep3{lW4;mPPP z$%KU&{y4Zx!L}sRDIHgjA^ew)pBP5?PaVHIkg!Bn37)?<1QgXu!LbGPA^Onbui-da z$9+LBq+n_B->CFMwAe|jAMTyu=;HN*zl(}X`FINfFdkt8Cn8ZK_ECS6;@*n?cmhW> zG59t98i6$t;VQ5y(iVvI&~?9x5yYcc3BX8v>hx*QC77ie zuRU)K#Unq6h+oFpoPbIiXLDCz<81B*Y@E$7TC|zX-GPnN(gWB?ErgBKLfA+xgkLjI z3t{8zB5a&ZgpKv@34G!zP#YS11hbZ|{aDBdufADejrCK1!vM) zny^r>1a~3q86B=)U*P^)`S8ndsflWR;7^3>z_|n3gJ<=_&ki*`)%OzM=lJXv^mZw5 zUvs$p{=f}f9TD{*Ja1e${xaaVd43U3ct2(Ors>o^vx zFX3HkJmnbySF6TrcpT^UqCZC>{@*G+(0E=Bw*s?FYyTC%#`awad>`h&7C#F3bI>Q1 zeH9#C2QCwMw2Ha9Euz?0xGO3*qUfvf^O8DVG@hxzcN*fy05_}kqi2kTi{|3B7%#%Y zTp{R-@Y{U#5UUsA_b#FOiq(to32GpH z@Q>#a7SAV~&Ev)M314d%-!$M{15O9-E>nIn9^)uprDqBL3^-%|j|Ud?1&j(c0a6k1VEc%0RZ$tczz@Hf62|s+Lnjg=<3HTuc zo(?=4^G9D?*~zo0TsI{* zZ|bz`Z@BTMbK9!J_H64Q`{3lE!=QJd>=hA4Ir(PP%((L20&HBFZw1yUpJsv`&Pe%$ zjhuA`FdvB+ai_}jkpQMUUB;1cAiZ%U@`1PZ5BFpN@Ph_i2uyN1^&A;pPM>bQi{yC1 zh~iiKp8XY+67K1fr@v^6?;<%r9KSbpjEY71mh|kl_-U;_=wVJg)Y$$a;6{zJA-))R zD5n%rzY^fvAtw^0!pmIvaez}ukn5DirnsdY1z#3)cN=0?82Io^;06uDPw_@RT?$;O z#iR5x;J)g-2V`#GAqMOL*7+j*<#2*8isuv7`6B$Y;NIu!gy6G;U*lM$C;S%YdvEi# z$P1jq`S?3J{({H9tK)YJ^VWy-gSgpC%ws=rVxs6Rn%5P;I-dic4P0Sp?;POU4SaAe z@QwWWf)5fduu^%VzVm?18efH<@Y|d(VSM1f9d0^LkEg4+1MzK8Gldg{T*mVwQjH&| z##1=O8>!_Eq%l$pVOiz-@UlDcGs(a=<^y-&7#{rp7u=<4yoS5Ai#NB67wbL*cjV2% zGv4c`QXlYLa0@u!g-6AM)$!HvZM^-WKPY{?jq*q8>0jgJ2`!Z3SB<22q2&_ZBopqa zrys)07g{OBkLBZo4uzlajU-pISRD&FKTgN<22eZ}0X2OHauvzu)DF6+{&bZgoUWOW z3+U>JS@ z1suFC+~2E#O{xY#{l5nI!<=yZTHsz&!gw8UqQ)tZem(H@Dh6+08-R~;&H;dHBk&ka zVnzB*z(ct`LvXfxfKO}BL;8DxHF_dCqH9wYevsF7efQef<|ymMs1Ms2 z*|P|@UiJH_w4q;E?pD*E3J!Ko=<$nXt%|#Rep!z@UVP6&_ApA{D|uYrABi#6Z`J%S zUwv26hD~2serkh%wp`L1?FT)}i(!*MR!u`8n%#{0{>dd+(VqK&g+@!;{6eF>2$?7? z_0RnX(>6#6ZvjqCq_PSUVx<)J+J_LPrH{W% zq`$3exPJQ(-(KPt<#lgYp0L*$%liuQ8C~u3bGZiPKCITqsBu1mFr&t~ANV-RA$#qk zYI^Z}XtFBK1iexGK^1G`OYkxL7&Vl~f&Z6=Lh(iog)r|Q+?(L&GHOVN5GFKWv2u|H zD>PtXPbDlg;8;!rgoOqy?5Tu>1}yBUgoOqy%Ci6q4Oo;%*r)+N0c_NOn}LlQFkzzx zOxUOa6E zC_R@H#C##8Z?xo`y9QW37Kfa#y(Q!P-7wC8=Pk*6~mvMZNj<4Y9FV^wXJif1v&*xa!zh6ZC zqBs`zZ^E~6+>2WP2~Xp=w~l+O^)n%k=U3~e;Y~dKg?jph9ABj4!D{`q^apr+Up-#q zC$qZp>B5NTM#Ck*jY1IEA;%Qf-pPnFpCevow&hz*amhq?bRoO$$fJ-$7|4^aOZ4~z zX8Q(tQYa7cT*#;VqP&oO8RScnDfvz$41d_g(41}CHd9;_SS(~p+X47vAP&(n8Z4Ez zqri7VHw#yQ3Z#qf2oBCzit<0n@@=Lf4JP`%&9Xaa|*YAD<($vl-06?!Y$f z4pZF2ouvpm5{Z+mI2@{;kEGXl_(4hPG4mQ3Vh_G$5V(n%&!54}9ZT81fCnuqhaKWh zh^%)pt69O!U&R^&tC+RJYG!R*#~u#c$E-u|haI$uSr<03@<20cbeNd~hnY3c?mnqEQ~F9W{<{0jW9;{Gb0c@$yC zknb4q8%XyS@Y}#|qx^T6wdy#+-$VHOa37+~k62E`CoHG(Q`|pCeZN3h3$u1>#VYhG z!hc1&-%-XN$oB`cCjAM2f@JO1RZ5XAlB~gtBy-?m`1?vyurII-oG6*4ez^COtg)A% zOOqri04EKUSO88M1QBL1{6pZ95k3@QW~4C#r{F#uVIvSW5_ly1mm>^Lx&ru0_(vh` zD)>jkk99$^BF+YE15O7X2S1!C1OD-FnF!BDn#qzcaIa*IJRn(3SidR{p^nXX^3#$z z;u+kZmCUB+q@&XFl6eVS2qY+h0^n7;G{1k7W@MFzeLzqD3{!S z;r|-X{#vs3`Ud`A5%w$6{)VvMq)pQAz`vu9{y@GzQHQ@IbLAvBk-*cYl*@9WQvwBWMbT_03BXC?x|j!F)5TnQYZocd1os5a zfqpY##pK8}AV@NxWO(kJl`NuS2Q6ZkaV9Qj#% zzJ%Q&(^v6FrT@eq4g3f7{u=kMk@p+8Z}IGtsPlL6#{%CW@AvUi;CrO`0r&^R{|NU} ze2Vll;(kN%tKTy8>ZX z;tnT`LfWf(T7#o|noX9T)^W$ z3Ge2nNS`1KPWlvO!kNB8IbWm9-*ctF_Nj8tfvFEk%KV1{a8h9Yy8$>UIDcONPO6;$ zcpx9{ zmGjHGU8z_8RE{Zi%HqIclk%~$WC65VsVi)Y(NeTITIwOQt5&D1ud*&z-U@C}Z28I- zy*Q>!2Kti0`1R#j6xO6pD&t5mJ^V+aeF;Jh^%S{$as=)D+j_py|Zni{#IT$Pac*eDbZtiQh>z-$_{S z5chG^mMEo$p8hP(;z+cJ#uS6<)car$@fKsy{RKxC7LdzSJ&qjqJ zHZf)Wns;js*7S;AxpGJFfexJ)Z9BN1MO zRDUd0SF?rB2i8DZ*}phas;W^oS1X_QN{R`riVHSW)=8c5;185EdocaM;JUzi{A-TB zQmRRicUC>591h&0{B&NRIx1*=H%2*#WnLN+ir&(3!`{k0Opa8xR@VkL_Kprd3b`hD z@Tx%bg4Yu2I`m5F`rs3F$~~Xinpm(VSV#W?wF3enNvhf_hZv3SLz}Lx37ic6iKlgh6SbWdR%8K9@-QrCV%BoI^bwyzH zk~-!7MXPFd1@}n31C7e^z>@=G0<|5LdoeB#v96t>l{Ly@{C-+h9sE^_P-aXXrdXFY zrlmF{)Hd8BDb{Tr)FIrh>g%vZk87vQfdSHszbe%54++Vg<@T2TC_ZHAXd3= zc$M|3s}htI%CV$~=z#Uxi=qQ-0&iT!0{>xBlJZ&CUR5?zwPZaV9idnoddDdnLt6*- zRjLODchyO@yUj_;Yj$1hBdaAIgqtJx^l|&U4a#8eS_5vUDj7xmjx$0w!iYhQHzzk<@$`t=Eg2kWYwWf zign{+n@4G?wEbR{{?Wp37ERn;RoV$O`q61?E4FD4nc^~@h+?NYvMI5fo{VF`&dida zym7wu)jsl17cxa=JvXsux3Q;o%$RlxvqY*$kiPDgXzMB6+(%09D-C_s*8hZbQtHBN zd!I1Hz0u_`Cf9By6cM=sbI|th%G$-3q0bdLrdJe1=Vi+4inV5u^?v34=mp!JU30KppT1n%y@ z&P!-e>Y{^-1EG$CWA4VON@+tcWofVhIe;P)mMHas6-v!j6c?GWJ~~*hG_pYneQ;hT zwp;Dp%DzzvE0l(W)m^2)`UvueA`>=52kHZjC}CT4L*)6vl|z;US1Q%4%fUTT?ZSi6 zOkT;9kW?+n%JRyM$`hkDuc`We$1$LI zA6ZfT@N3HZyBilhvc4`5dSLbDZNbpyK=r~MvDU_ZQO!F&I(Lq}w^muL zER`^#i|_gUnTKt$>w(Eib$@7mU~}Kd?bh{6Hdk)0+`4FAZH-djK>};Q?^Cub zs_zahT1k`qnSty9DIu^Tw4!>$;iXdO?$GKZj}B~B>U$-u+rBQi?%q*r*F1vIrFBcb zeSZH#br02TwoTtY@a1)(j(2ZgvTOO86}1l^h*9cxZd|o`^E#>Hy$Q8@7FRB3%DqdJ zRZ9a;m|3rSCA4t&{VKsNQEIEK>mOcHxh%MT&oZnRkM7=9xp~hr<*^-g%Cl?kTWCG- zzz@wEu98MYudHXv2Ul%rzzU~?wwjkKHM^E7OP;rNs8;T4RQ9fKHAmmSTv?SAy>YQ( z8^5$3O!b~WlvmPMf8Nq)eR|@xC+f!yYg{n-K-%~ji3id~E!@!fO5^$^dm1V?EU#Lc zwx{{@3-Xh7&C$x*>wj4^?#=DhGx~ke%N%X%SFfz=sx0nntIdq~Z&h8edSU2#=l|FB zbOWuX)+IYb3mX(0M&SY5r)$%GF!zeCSFF!G_OyB2zFrUtqQMHFpTnL8-JVoksFZPd z;SaM(Y3vuNG+viJW6MVybFNxo{U9(cu=o~p*2QTTWqh1Fu`0(-$$yTJw{&FNW8?>8 z*<*3?)t%+%y2zQ`*xH_KXK!}+B1OR;zk*qGID2<1%i1A7_qP1!U-EiW;)*EghiGYE zr$k>@$H?=f3(ilh=_8Hoo7jAtbjgGF?0Q4;ye*yn(s65x^zqmI_Fh7&JY9Q2_bG2F zX%kvkV4<(FMe|kuxtcv2l0Hir7~MOxf-mp&p-t7*%1SV)$Q{AQ7j0juY~m~`Ce(;! zG9@Nht%PDiizR?du*ff~O{jr)R6=lBOemDZlk^NC#S-PQehHP;%HmK%)qZBCm0lE~ zdJ}3Z_eYy41rj#~k3=M~F`<|yX<_ZC&|6Y zp~mXkAZI;`_bgi!S`hjvVL2F&^+40UIsfD=tx94?MUe6k4#Pu4e6`Rdo+k?p|CUs!>9r-HU5G#)LKr4xwzjG+_OD zR7_~b*T^h=mW>}>AhHT~PD*apV;rb2euF9P?=AEHI zn-?pg#0Qkx;GV@-E48oHCPiD<)mDWD?~hi81M772lIl>eqswYT);ChB*92Z`tPdTn zTNHY|zA|L}uHJfI=txpbFBYf`{hTsfS&JEob-HF(gKhb!MGc`x?^YJ`Rk~wnj~qQ9 zWV@yk(%_!qRdu1f&!ezV$AsPt-H*k3RVe*OwtvJ?2zE2Fb_Ax(pmqA9e#5R>$k*wN z>IZG7+b`9hVxeAG9kLZDO^a>cElz)P;Wr~gQ|=CxMn%y&-T1O8uIjwsJFxN?b~4s_ zeJ6IZ^Ni=><^P^9a!qN)9DG8+k?$%P zLO1yFr(=)`sLai5v+EvtYRpC7SLbCdx3e1Lw( zOnCh>SsK1sg2Y4U&eHHlv1j@!W&)PXL^4mgr_5928A2YG=5>^mAqF?{)8CvRfag@; zYYzOW@Bo##3Wwmgkfl4^_=YXoW6Ss8kJ-?7TZSOahX^k<;Qw&;<^fS0%j0;>%pSAs za4O;o%Pflu>MDy@@B$VVx$jH7U^xWj6j&9-IJ3LlAc6uC4^-k6FVGkF%AW?yeRP(#9;@dsUDs%rrc{ zvD~~&2+lJU6d6#aph%#LG=hT^mP|oT4svK{Bsj06%urrrO)C!#s-W4|qLO0G^2*9e zq;Ut%ERBFP@diT{1ml)H`Dk;dNVBZmxDkRY(Y8xTg(kSPtOA)bydOclvaHY=RFaN+ zewPTDEX7jR7L82zQav2pE~1oB||s3LwAk$Yb+G#T!GGClb@bYl82T$Dh(PWte(c=k`h6p z1SN$1laQ_`gRmU5^0PrBAPCDx>u6Yd8i9atGA{jk2B;I8rJ7);_|SX|94OsmH}Qm4)kp?t9 zldp*s3NjKmhexXgn#kg8ApqNhkSp{RxD6?{d zXwVhNlC{`s1cWs1fLWZLC|F!ePqgM*6PaI8jseDOw0MZ+oQM`uAj(jpK`222O;;jW zQ4CQzrCIpQ1O!p}MVUs8;38R!y9=l5ki-0qaX|tngp~_Y59#cD zw7XG&b*oGxU}W+PYw__Rm$w$VLcB$xFNzlGS~Qx=6)K*91tuRegFDCzypRm;Z=54A zWm(8ziiV>9)EkV9mM_;B^0U!ykp}5C=z$v}<)`D?BCLDSNTLrK`ALt=FEA7sF$c(@ zS6PWrfzyMHXjyfA4*CkoKk@x@PbhdobUqeaTp?~lh8AKl4Rnwy7Mg*OQK14ymz8J` zP!_l4wB9OWh{je}B$PrWKCc)`~L>jE1Z{V@`S)_Di{% zu%hBph|Lvxv)Ekh&0-7FgY)vS;=~r>#@(@n+38_M?2fISqd-}`!f`V|d?o_2@-b-M zGf!wSnZg~%7|JrO-f=nDcCs`Adcq66s%9CQ;j(%pmgHLN1mY(i#y=&L_#~kuV_5+v z6kAr1XN{L!nVV-U)5IFFJBuyL$L1beR%w7(!T6viwmdfn$s$9s;Ex!vZ5lS@{pW^r z(WkJe5{+=?XaovbV|s8t{>d4P=wZx)xI9B{IkstR&e(^=<(1&yo3$p#0%r3fRkZ8asEVMoiQUZ$`S7L+3&R8I=#&?7^pO}Z$ z2QBfe7s?0m21v}$&K91EfRV{9PQ_%fZ_^~^77L-pdDuvVW}63pDn=B=|DW_kG{J<= zS|c#%Q(1z>vXH4P5tiR&Kkk173XPxO9v%7VSi`WM2@Lw+v(7>q>pYrPF`zMZO;T=Q zuE5}*AyzSgKn`o3wc_Pi=_DbqQ9@rOgrwx-KU0!neFbs_n6ls^S(IOhWKkiK*mDaK zSXfCpg~nW?MnHh6U=kVu2{cAT2a@v9)I638VoVUbd29xGnxr*CEd#XjfS^0f&kC9nKhikq#*>vX(-N$1RvluutNivG|iJ*G^3N1yx(Y; z5)O%pJ~3eu!wd7I&&;E$=h;|9oT3_`8Nr0mjZiOY@aqzBexq_^4v3l?;iX2x)OcFd z*KYgb8p5>ZPVjP~T@E#J z;N+xPPSja_%yKCwr+7J7bynKEQ^E@b!R;i>JBj+8lDeHuOTe@QI+j5F60j^GaHSTq<|Pt-iI^7%0{u-( zhow>q9`i6^>{u7=iXva=fMs)4H}YN|=DnyMCPsI3;)R}-dc`GpROQ|#`T z%r6CQDOi?5rDPdm9UhjmSPU^7W!nRJR=`<_&&dH+z8Hc=q^A>U5 z#B<)9!t6cT?fZ%sn7xP^FW{`iQLDTEub$hypx^2<54+&E|ME)s-!7$R_#h?x5Wc1n+RE1@^QM4K3pO7IAY6vCmKY zs+2q>h0FD4ZKP(K^I_z+FwzuudTpIj@|-te@~*9yn*2CL6GDxjS;6^LBbXFC@}fhb z77eHDMc0hb6v`=wLpjZ5ztQf{b`4RjAr4vHT5F5KMuq1-4e`7NwrQYQ2!b{Zf$gnM z1C5yCI|^vP21^LeHU%_=lKT~Q`~B<=Ve`Z*VyostpF!BJI2vkFP!HxSCN?O>e-fY= z?Y4g~PC;}lV3bzepVl2ZI&PAvX3`(e=lm`Szsr`})!{|sv-v;IZskV`k1j2|r=?AW6m?p&AMabMFl)^UczZsM*76F|d`|JcKVpB;bGGo2FSIDSZF>~* z7XN*|a9Od>_qO7cKc{%te>7C_P?oN}tazyF)_$rvNWO58J{>iBYwx)G%6Dn$0mY~o zZ{~8Shz|uW6fB`G&7mh6$a;nN{3huzCvD`!-Kvv;n3KSsEjHYiJ-*~?ivT;CMHIhi zUk1D|fo`5a)K4JH6S^~ow!2uiccjXyy$I_$cDv7E=U0bM#vIBks5e|rrV{n3;)kxm zzVZ%Vs@J#Fq32^;Eio$7PN@l%Tg0NSd0?3b+&ti|XZ^fUCz1WfHX>f}hKM*Pl5irn zMbzSld2IIMl?N5jrT{aRm{t-D7=lgQ6Y_;RKe`K3}rhmw0^Q7*~w~Y7{by zf@q9{u1IK$1U?eBMH0=C9;1^YMfh}2D9Ad+>l$cMkep`L39NJ(9($t6-f?!E-!lrT zr;s)kJ~LhPT(M~H9^m%$lu*qj)81fDoA$0J>eq{Vj1-(C9l6bbExXHo~Pk6pn>LU8ug=jo{qixEt_pBqz}APeI*N-5d8Aq;&?Lwz)Wd zFS5+ty_w`Tcg2Xfn1Jr(ooUpLG~#5MS%(AmqFNo8bg)N9m~>Pt|;S;~&GZ17JEp z@CPDHq9di!V>QlQ_Ge$9^Rv7Q{=JRykd071y`Udxj*o zkyHnnvFs&v26cD8oZDaHL2w>Ktq1TPuvc)2Mi08)BcwKqIGIH>WKFu>BfVS4v^e!w zO6pY^?R5;CV4#_i?P197B%(bDnv=q6l7UZ#wQb0Z{U9YnbaMsOze2Ko zMF6*h%jLD4-iFuOK9qLukUr?%@v%`qt!_uDQ;pdlYW#us2hM-=(tMM@9XH?2G@s!7 zZO#7Dk7wlO^^DqhikdvhI!{TxCt>z9D@uufo%AC*{OHkfibbRC3fW-=@v_3?w_Q<- zolK42UWM83qGJ58CPT49A;L9To9&`GyeQ-3aRoI>DdgJ}1paN{`K&@V8m)M$OTo?O6%2;fDI~nYwpx*~;FAps zYP*8OUS)KGg1V;=V^7a1?9e^0kYa~+L?PWP6lpY;mAqL&pddy*DU_zP*_sftqq7z8 zf?{&LBJ0q@j;&hu+xNBN(Jflyp~M5L1#??laOvZhwK@Dl@@uW=+eg|>w;pl|<$Xm4 zJKExB8bnn)&J#k%4cCB&;_DKS%3_3R1gQ)aFpoNKiD=F2#`Xg^No|Y*O4Qhn(WJ!V z5Ef^&5u${|@~YW2jWVzyMd->XQTqX$?1oIH;LgSwPGBon&6w%4Bs9K)Z`;|0R<570 z$T{GgOSwutD_M|;i_fYEscvW$q@4fo4gZt3Or%mTjx*wQLm8&T9p@l@VD)1(R^eAMkDWa8e zYx-H79tXBGxc-AwHUd5e96m-mbQKqX`g+xj(55>=&@_HAF3Yg>)z0@n2x2Q19va?} z?1?YVE42Dc$2_RVtPCg;|4*NUipcr69%)PzC%aRaB0*@Eq11eT5-&C1KMkMq*p-mu zoWP#YvbdyLy9n1k<7yr)p|t}!p~ZDkgfi#*oIM)q(}r?K zfV5MoXZi#$SsWL?GApFDi?n^hTUiR9ECw%*TZv&DE8}+0RhuK2)$6x)*HE5`}_^*DbO~>2G`KxEX zCLE1N=L_1_Kc~4yvsBRI|JCzJj{YpUyxdxBIq7Im2*2wwbFduC12vg{_9;ab5Nd?W z45e5Ke+UL!Z>gfJq)?NE_U}<6kC#QwJ*w)0Fpzc8^W-t00>*0KJWlhcJJ6I0_YKQ6f6CY6$^yFm zJSFd?ajgpoEqwr+zI9geL&UHZffLrlEY>9khli(!>7%-DH^MgkS;Pf`>T4A&>72jMd*t4x1l zgIR-qLDqmI)W-gIND_o+=Lka-rNUr=Ktn_cD&(GI>M;YjonJm0bWe{h!_A@6LpEmR zSk>>ED73MHZ3I=rWoWM)gM!gicX}MAP@#zl78K)gkGDR6a8+o17-z+VB!kRgM`D%xFJW`{VWo=z%p!gB!&r;?4-z zQgYIh1jVN?w3H}NsDN8jk*+Vnjv-rSX6(ZV6rfVftBTt!q6mJ%OXY4 zzgqK>n1lU?aJiI3_;aR(?jh&#gN)7>O!?!btWPo;LW)Y(=0A3=n-HQ!cr2C>ta&)b zBZQ?tY0jDur2fk<9Y^P|cM;sNkT~3U3RAG=M-w7&PpU$8dR#tc?#W}sdLi&wi>$jQ zq=)AgqdHR9HT+MHM<0%rB0W*qHA$!O!A|MK{s2FE{8kNL+19{(l5vOmW{CfMrpxVVu`1l?Ell-xQ+AE!2Q z4FZjwg$hTNk&X=d;}E(LJoMH>^nV;er~`yq5BmQ&F!e@CPT*BW5g(*%a501(UdRLX z!vWwX@Do5KS9ziRk|ueCA@Mx`W+q#DdS5A?2$;LDUk!T$Z?$m&KF6Hh=&A7 zgoR1TkeU{-Y9%Z+WCdlTQQbUP3x#M{7XpQtlVAtl(LC_NYfV;9hjBQ3J9V@d!0hiy>NwX3s3*vV!O9N6zX%SZeCx!C89IgNMsP^+iUop<=id=}p@JBj5V zDCdje>XmE5uUx-*AEN$t6A@Zfs>0Rw^8GQRlm z^R5AWAnD z&5VgdGaq=*JaaI?LW<>!~a30qR$_h5CWj ziQv+92qJI}!C(PY6YId`$~w@8m4n{A0fNkxcq5ykQ&)vDTR<;*8iMRN z2;yr&Ut5n~lPAE1dI8L2Ka3}DW14qxSO26dFGEWYw$;)bpJ#HPQT$j{SNplPFxxwh)V=TTndyR*b)BZc=U5dKNmvJD+#?$ zOX$hDNY5km=J^PIguZ4WF3<2Mss{|jDN`Nc6SSAG5WR$D;CaFl7(rSBqeu%xle0uA zRJ;C78a%OhroBt5H(3 zORSWK)l&1_HB!BjlLpmqljp>weS=}&N;?C;m2%v-QkTJRrT+SdDEmFe z{T{;+Q$Ha7QF_YsPsBe-{e%Ap@z2sz)GvsCmHHF^l9K$tq?gRUVZ7fl-tXv-7#<=2 zNZQFglDgwmx^@fTWMdKCIUuHakkOriGP;YC(foj%t{!0MKCq>$Ia|7Kz?SYL?CH)y zNBZo5Glsj+?P52??zA(>(yUlTo2%8dvwjMV?T}Uwfi%wr(w7GUX@yRQayt5QU=TgC zItZ^9LU(c@bbHWJlntZ10>h9G!|R9B92br_f+l&?b&4WsHYgh9W9Y7d7}`w6Vw`wP zJBi-SCDDp&Nto|clwXGVUWWNbJg^M;H00BePosAaAPvhgjpcZa<(STLx}98s;VUtG zCCaZv`BliTLVgv>BMqxjel^OkM)}ovf9aUVOxhn8`&{A*=u5hC`V#Q;r9cy6GkuAu zr>min?h9yb zbvNm5(L|YN$Rt_kfSc@)NGY2U!pe3Jc*qWj)UqidlVx24Q)N?Zy<}|jOc`rCSH^P- zWoN-`(*=8NIs^CGbm2;XOK{%CnPBDozzT#T2p8oiMFaAa`XTvA%T>Aghimeg)uVDs z`H6gH-FI>xR}z{{wv0tSjs0R^vC8O54BhNAxn8J7tPGu~d7gIgpg|ahH z))&L(qAUVG4`t^g{}jqDVN^p)P&NQ%1DKf+Q4AXr&vf5RWKKG#F;s0fqmyz>J!fX7 z4Vsx_Itx<|)yyF8BcQuGgG>YIc?d^ z92nZmoP%!WY+yH2&2=;8iTfGPpc9N|$VsMi;52hU)XN;wonboREYlTumg(dW51eIA zx;&5hy3Cv<2AIBq0p=_WGQPS&=G?#_(nCz2ZityfTw#3qD@-+9W%>fIGIRK=NDnjT z0*9IN9O8jtrVp+$^K{pkvjf+dKH@s!>zJQcFh8#_ef%qoPtXla_a@5TMA=*De~UTC z-NI|$Vtj~Kk$x59AcoiQ8m}S$8s-aW@^zGbgX!bmKpru18|7{zzJqDqVa~!`raJI0 z$|D}Qi+Oz$ulFX#c?-+oElmF{lzAIv-bR_Xk$;=<5WmArseX?+M1F{6F~Yd;BUq*% zF`c@P7%$=;Q*FA()DPTe0z{+e|A5&Y_<*@=e!wV#K4ru~pD_W!pEJILUtpSF;->(>W;M@37pzV_d}FGhN(| zjLYDUj6(NMd`ACdcEeAYpPv{P(@%_o{~vs2KQmK8er2W%|He$wJ;Hd87>YPDjfatG z?fh@kDB|~N6#4FSKJbI-rtyLPrmYeFrhv8nf0z{}jz0WS?a9dH)522f&4z)7Mh!1+p3z|5uF0;pG81KO{32An4L z1XRP`0H5l;0Vfyk5Ae~y9KeOMeb9 zM~~`S?Z42q@l*9}1Jm_Re5BrK@UGrzXjX_5UmVf~F-zObsTEFFiYr)KFtW`OBWr7G z>^6@xvh~hLPeMPH(b>Vv*d6R+><;lozq#nQ(AZAtjI2HwWkZk;HMUD*kWN5431wCw zHXzPJT#VR=cr#)X;yT1Fh}#kGL443i5yy<(^m9f&@D!$T3URNoyQ$a654>QUNu4)# z*YzWP(b!GBjQEnVo4JfK!^WBBVT^Yj>021@7UI`1-fJlHCdPXUYe5sbp;Xvvwz z{d&s5fp8+m6Dm~b>xpP0k;o+Sh_%FeqK()|93x&Lt`m2Nw}}hnyTl@RpZJhC4<8f1 z5ezwzRFa;g7uiG2Ap^)DGLnoT129Ys4PO3B3miTkY&oU zWqGo-vQpVbS(S{F)yV2)EwWab7Iw(GWP4=$WCvu=$_z7KE9mY%EbEh9lwFs#+Z?dL z!5Hw8`^uZ;2jqw3$K)sFee!ei3-XucgYsdy2Q!aZz${^OOb8RsL^JVBGLy!XFzc9d zW7fQ)%IET`Szvu>+QGLo9yfDo9*}6KWl%? z{-k}s{U!Sw_P6cdvH!sSWBbqSzqS9>9vnmtG6#EyaSoFlSO-ssX%0RPvmNF;EN}>L z2ysYrFgR2?R5@@C?G6VV`W&t}+;Vus;RAZj;W5z z9g7{;IT{@|J8p609W9Pcj%|(|j(Z#rIv#aA?pSi z*KA*vo7!!%+f+Aix9M(SZcn>ib-U~KuG^^FS8o4u!xvQLG^Jj-R2im>P(~?ZlyS-g zWtp-<8nQRQ>W6UtM{Uga6(3(6m< zex+3XqLNf!R9;2y8gj27cT;&6xwnve2f6o@qsTo#?o;GGSAK)sL*%|k?nmYCN^mFL zMeY)J+TF&Takq1y;J(0piF>enhWkuOo_mG6Mq+XQ(H+=v>=f3IUC8>gdNzWMV&m8Z zb~(F>O=ol1T=tx{h#h7>Wbd;dv!AnbRC-m2N3zEXk7RYZCu*kpD0xk|s!nB@Jx9f> zj`)`N-k$4wd-j~$b9J1K*O_!?U7fB02Y!x(a3Oq%DWoo(3+Ka4;dKBp=2$M4k2S@b zW0Av61h`~A*_2$DhHv25opT1>U^18ubq0)|btH$&;d4wmb@^OApKr>?7{%riu7oc! zm6%Jc@r|63H=2xfl^DOWPG`~8=#B>S!KUEa;3j=jh$W;Zq&DPeNK>dOv?jDR^hlT~ z+#GHRuL(aIUK<{fzc#`Yc_fODIug|s1yGGWFRxwR6uUclw;r|-dNlZ#jSv+PwYG3= zOhnAu;2O$+4r)W- z$U9(p8!WLUh<#ia!c`E5)}{d?&?sp{fEcqgmZU6n~83Z{mCbYM1m`X)ipF8nb@fM~c9{|0;f0 zU&Vc{4pFvfEuOjqccj;-0qR9+kQ&0#@msrhil}a(i1!n5!J?W9QOg8Tje~I3Ig4uE6V*)+)wzi3CW5BXwwoBUn*B{_}iT3WG`NntKCZ!^~rh8Pjh%j9-k{A0Y@qhdXHpVO%|g zz%~NarJyF`P=%ZXs6fUSuQ+`DA(fes4LOiTt{_*ExhP!#MG#4pKoU7Y>7p#fz1obR zRF;tIVT$q$b(VUbx<*~6^07V|VLb>wgI1peG7FN)hp>{w?TtwTnM3B`i`80kvvMz4 zL{=-i$#rBYSw@zV71mcR6KN)o6ZQDQ<)&;To5)SDooprB$bL!(hk~Fs2zr8`?>ZV` zfm%KE=%G&!NAz&giQt?FJ_JsNK(9B6Q$}lX3SSu1hCxpl)P=#3FgO(sy>AH9+wkm( zguW=~neT3i>Wjjc;pp1vo|xL0o|wLvlWzn6Hq=ECTol2_0iLx9!r8Oj-I4%(iBOw} zG*O#D)MmQZCIOy3Nzj)BCzIjXWav$XlX(QcmZ(cHr}U(9seEc(YHe!Ivf5>JX|>Bu z%X^mh<@Ht6ZD^=$FrZF#D^aV19v##V0Y3!XkU*ICyPHUYCkc+kq9Bm134xvvs1E`2 zO~F1<>B5E2=lA%ru_uJpWyc6az;#n=t%}V>rWH> zX@WaVAYndD^rQio2I$tOfw@mmZnGS)Jg`Hp$j~fDvpmfXokPZfY{dZQ9J!uZUM{rvHSv-_hW|^utS%r9ha${fh-ru^4)mVFqR8r z`C+8uST2s`HFmh2;yQ(M_%h2~ zX8FrPNz`1REI08g)P{M{(XXl>t@k@C|DCb?ZfLP(wel!`&2jOgM*CJ4w}lj%Z#*O(K^YaU{vWv90=WO@rZ}aHi>Cu1NqyH_B{<|Lil)9f*_siA&o@!xCXo|Xj zhFbU`JxeY8kXWql4_5bwSOvn={Y&uA5lcngAFb|R4E_GlpRMlCQTLar``4@cH>vwg z>i!ya|3P*CQFZ?@b^md7f0eqwRo#C^?MKmCU+@Jj%+`7%o`yv%aENDXr}^S&j=;^r z&{^JC?$dDm$N<*N;1-Wdtj9;w``4yG3|i_ANULtz|6)KqOvQ23!UHc1?oNQ!o3`#f zJox$-FC@N__(|fsDQxQBmXT>TY0hb0Y2|5gE4URuudrXKUg@{8c;&j4AFldr)px6Y zUsbkx)9S6Oe_Z|hYI*v&^tg0GdU^VlbUJf>W@M&M&fJ{ZoX(tQb1vkJ=6sg(a1EX7 zovSLyET}9vTX3u3t%45=>%Uq5;f4nre%P?EvcK|DWyPjjn||3;UiEX;{H^g@8@9f@ zmEai8iJQZ1#dYwX@E~Q*zVBroBzs z&85v}n~!h1xovk#Z_Bxs*6rb~*IHj~z0E?VFu~nhle8?q zcyq_0lVASNznpOTnJ!VE7?K#N#o6k3M33RvF&saJ6UT7!7)~9-X=8ZB7+y7o)5ov@ zarPL!W(?;cE0y4cg;~g*=@c!>7k^-xxkShR==R^JDnJ z7=CFCzdVL7kKsYYSI6jUWB3)sZy?-7cpKq8gbxu8BYcbSZ-lejSF|`B z8Am%udq)TS9(8i`#vyZqqtNEaF)SX#LN)|{`53kv!wi18KK9SYlydNE^$F)R7J?n* zSdMna6vb091@Wt5bcu9sLFwE=@7z1BZ0ct@)AMAx{*|^#m1PH-R#iTq@JUQn(wY^Y ztS4fxHzg$&RXWCg&Hup1CReSl&1u;jmlQG^yMZ~_5n!32xj>0jCdVRiaCAc6KpH56 z*dQ@T4Kjn=z!-$Af}@?`JmkwAi7de_cKrXJr}rwKGM1<1Z=W7tn)qd*c$Z^rSA15% z<5K>7)enh_5<6G?C(mwab6`Hq#VpRl{*2BQdM!FPEH|etHzy@3NqnvHeSPDyzYr%h_5`qHaPiR3G3Zb)4 zX-{ZRX+artQVV`dVhR6ou_v|v&>|N|EuJHwxv{SP0uGws+N*^H+Gn*)$l}Sd^3aJ8 zej3w@cJI?dBuy?o1pz=GQoeN=V?;Z?Dn{q_! zM<`U#lKBNi~O2FCx@>@X$-2)h>Y8$**X~d%}m>AG9~L zCb8xf*i|hA%reuXDkerpVxXV2JPb0TFkZnzV>VFZLR$z(71k#MRP(s z58OiM#kmC>)CMj03R)hnhxjX6FA#fwt^G>-mevKl-_bfx1?RtON400P3w0AfcSWlK zu@)|%DPX~!ZFTeFaN(vdITKf4r)MrX;VltOC0=FBMMD zvrnHC>yK;db!Z*oA{w{>T>F$_~C$kQ-bw zD?2E(GS3hemtPzi85vzrQCL)1jO$7ZHx^~$lF*`(!nm+fj1w0Z9hXpEmbgAOGv!W^ z?oN>}e3l~=`DZyok$;vWbPS*6;F{D3QIsfnY5Y{wc6%Lp>UaT}a6GK($2B*%z0!22 zcy`QZiF>;DbjPRNX{}8TOZ&-?zrK2FK+TJ_Ki9QvC)c_byvvtI7-OQS zz_n~>^Ijslzp+D;3PFG zYrbus-C45x*S$>}w^r`oa>Fdzv31`&4fmIc(le@_<}%A}ZX9a*pN{vIWv(2z_Jbn( z5}z$kJssI`H=&UmiGMZTZPTSK-Yi)3vHG9so3l<8_*WUrKaKe%<%<sn(f3s9=Z|<&JGpnOMVRP;e zxw@h~#j=VtW5Gs;Evt7G#m~yz*fAqcvFhuh=`D@vdV@<|ZFx<{v;_O4oR#C&#N-~$ z`>aq>@xWNQ^^LlZ>t1br&=HXMVzDym_PSjazgG8jr0(h7*O_~(=u7_ACe`M)s)4eu z(q)YUG4ss}6Ql`;SHGG0PF3{^_oC<5ENY3Wi|%Nwe{*$U{6MnsLa=-pK*bt?x)(pa z{O0<_m8&arDqAX3Ixkhdj1y#?YH(`-RMDZ);O+n3{_U>cc6oO_zxUqu^Bt#Rzle*D zzmf21LVV)hWJyY1O5n1i%d+t`a%V=KVVmK5Lu}52oYpnfc^ir*6{~UT)QmE9Me9cY z%J9mt%DBpu%2k!kmD?%g9%?8*ViajlVbiqhUc~LnGbn*HX5J*15sMamvV!NI7~D{a$7tiUWb}88$4|Bu*XA&haDcmjKw*4%)?_G9!_{T<1qmb zH#b*TrP9U4%S)y5!^0mBVPa$;9^v5;c*MrW;Sr68!H}65F3HB@>8H1B*}8R>$y8Ov zakY2=OqBqd!i3ZKQ{(Rd{`TYVApV}S{yYJHuUeIPC@TReep!0LWKu#(Nt$GFxNfpY zB9e+|5i9Z(O%_YUtk_dLSt6CNQi+tMB{%@Z+DdGtwzMs4FSTbKBo0ys+JVJaLe_~L zCmF|%myBm!C9YCe+Ld+nbe-%bbz|K;-6ksur9>%J(n@zFtMpV(MwPo1mF}#&r~70U zlgHUWEbGZmR!LMir%A=CJXMoDBp$4Xr^n>UlF8D^^kjCj=j6#Y5%LJn2o*$0;_>$g zSiBKAj$^W*vfhfEWbj5*)?1N_7!ihxRMwk8^VfJgD&dB#8GD?mC)s(N5rSoLmMDXl zR|y&LjF>E+%;1HQoIKfDU^HIICc5k|GAj{cOeM{^q->nqgXti z6v`h3;$bb0h(8L$!smFOTYQ_`C$UL#ydWzLzPpMk!X{WaH#IY?;Te0;4yW83@Hg-1lHvg~jo}|O5 zY*h~KjF^!y(#L)d?vCy-875E1O?h2$iIDYl1(7Q*p8;12Tt%cSg(u~zqFh-SMaoD@ zMzS(j%6gJAS64jc6eXOlt~QkQBvm%9BJ1gDgwRCa&To`M6P&FbfqS`x=y0-R86ATNhB$pB3I#brSP=o$kmlnxssGC=_=$=D?QXoC7vKrlOjB^+Nep12dPw(N)M4zEfS;aA(wdA ziq(u*Z6{W{iPUaNwOXuJi_~f%s(KQpBSu&3CRREs)vm~j#7YTDDzVQ%7g-TLLXlc2 zQY(~d5TlIJQKYn0D&-OsR?m}w{a#!9y{OMuDpk12rj0P#Wv6sjB@rthiIt#Kc}Z*zffCn1X-Rw+UIZQx028z>+Nr8>DklQc z)4iu{-a=~`TNQgZvSrf@lfSc3}4iJMc#ixKTEKmOVn5 zlku2>$5cGLyu7`q;h~lYy{nqQAB8_GeGjOfMra8+1HXQ^|KPKSk3RVH^Pzto=s9%c z*mEaN^`3eDh5i>WUK+SEeEr7FTd%(M`klAl{otc}_eVeehtPq{VaHqMav9JRy#1LU~-~GN$6o?NE#&4UE4x#K0zJ7==VAzWYFJbsagqKj}A_9g9N;?7at*#D&^|;L> z?i?A3x&quU5dOShAgsy5PYi2}Akc>_4UNDVkL=k=x;y z{dngIE)yrY8m3P1*&KhkPlT|Nv&r8d~kB#fPde*1SQ0jad_t{y&7Yv+z3~HAp(_D8_3O!C4!e5UfvKu7j|Y=oHixCdS33qy|R^N9&^# z^bwKxS)P{{nVGuc)x_)CrkF`-pVUuFdp1V3#$#PqPIN+3dUJeljxr%=3u`>q^l;gN zr12%~naNpz%CCs+pRbx3^FyLEtF$>Wlds&giB95*Ww~_j9AjC+3(3)~LNBGsm7!v) ze#M2-#LRcsf0U4#)0zHlBC11T#2`}>8L_8gUy3E;HpO+teG&IY+`hRBCDHLo@!9bk z;@!j-=H|vX$481gCMFZiCOZ$C4QGEN!pj>mlT$imvk`crzD5u#N;d-YPaAE z{PE*mc5?(W2)`4#?;x%e3zYA_UZWVm;KK&N!p||by{ZH z(FtEq_-l}P zucxmkVN$27)35vW&;G!WnO>0oiQhBnucg16{!2Qav2cOgf}I&}O}(B$V!viRgb8Xu z(!gO!(404i{$!W|*W`+3FI~Gbx8u1}ue`YmO+{_^fx*Slzh&lSnX^94`fi3gdpPS@ z)~tp3*-vNh&EAk*xG)x%wb^Jt$@zIr_!`Bc);08^PZzeux5q>7o;4@A_k)Em7?0f5 zxrw<~=7cZ$HMcr9A+I{GXzsQ=HgA0X-bF$AJ^5efA6?rs|HHKt7kd;O@k=U*SzK1o zjo&;k6*MoDD}P-WQ+RRl<-*qra|{(iP0)49q&A*z?CiI!knqD@2ZdzRMnMrBRGM_|K z5-*#-FsE7)%{R@jnn%p@3k!;{MyS-&_uF85@rI)+6_A{oY@qR52MY>&uD1(kgnVcD z!7`!xW_fnCresx!A*8S5ZfQYC94c9IYw~N3)zsD4)jp`Hto5!fsI94eH{|15qVAWF z3>*c?UH@*~y}Efzf316I?x~GyDlaX)zH~o+l{PdcHyy1y-Za?c+PtCJXRC<5)qJt} zVe>uut!;iScdP$Vy>t6_+Z|hH)w;I&wY}T+URzb$FFTxf{@U2s-X4CweM9r-;a57& ztn%y(X`R$o9I-xPw9{tinTU>^@?G*>({{bk{$SUf$Z1_ix`w)b?|MB_yW44Z;GTc) zc|GbMQMr3x-~V%z_<-HP)`KtYONstv-|zdx-S*uRx)*iBVX|&N-Z`!h@&YUDaR93V%Ah!Jjx8X15uiID-_SMap}@YSom53csU z2P0QtWC-rT$gp^15b(SQpALlE1drpuh0{&s24I8(r(T!qLGGtRT?dJgtAfx-3wZX< zy~bnY0e+CPdL4wxdr?|Qgd7>bYY7Pp?&EW?x8xeqbuiL-g?oh?;;ueNj`YeggIA7S z6^*>cJ&uZz$dMpdj452JR}Rt^keM)v!QS~+`t(3AV&q12JKSk?H}{U~fAXBNo>nKB;$L1a5wc zPw!JCJ{W+ntR;G;dypWmki?*Qz(f$3FfKL2H2SI6hI&_G4t?(T{Q@5V#>4%dMtl7T zy1%GrztFf^ zCY`x`O)@fgb`RcYA42xk7YtZ%14jmcfDtnaR$wm9Fjx8#@DliFoeAsnr$%}~$R0-d z|BCzW_$H36(X*>v70b44*_LgpEXk6=#sw0Ggaq%pQcVfikaCfe7?KbmmE=MaW+mB{ z8@B1Dn%;ZwvH=rHAaJP(Wo=jyFhL}ggciTE25#>6eeZtnd%yR`)6tZjnVoXx%*>gx zbFdq6_+A`$}7)*3W!G+u6T#$8ej(w>rQetNxQ|GL>o0ic@ZS=YJ6 z|8R@m7sF(<*izAUp~ZHB(l{}ik?3FoO%)nO(5(L)%@a>+QGWc2(rionnxWSD)o*fB z%5CZ6f!gLjl{!aL4rpY~6{#)=`>6|a_N{xjZW~)tPks>UNiEsGu8Rjrczq_)-@f%n zsGqS+8`ml?tb6qU=9ec9M!O_|>gDN4_ab>XmE{gjFs zrkSR>STsLHjmcjTsNmE=3cX^1X^F|BS!7yfT45@q%jtc= z%$zyZoNmrEA7y))dzkx}v(5d@+bnbFW9%M_zu!PJD0f+QSUBY%bE-03nPVPeu4$P> zEu?E{Y!ZHp=rqe>x>hA~^e>9}bFy^-ETZ>D)Rjn(*Vp{H6h*aNC^JlI{U zoNUQZYs^}+zy_EL*ecCrjn3?3L(D~NF&kzsXT#0ano_pCSuj_zQRZ2i3N{+&)!XSE z^iH~#-NznachRdY2iZgHLDf{vbPc6iX|b7)u(9S2X5O4;&M;@0zh`@!dzu~QzUF@B z0p{(N-SlyGuO-0mb@N_&x5a7RY2lTF&1uREWv+RsnMxx55T9vDxAd~~uz)%h52!P0 zx2e$LvXofdmNljsmT8vRmYEhXEB$CQNHJ;hE*4v ziYx_|QcJOAt*P2F-7?2A%R-q|ehM?|m!&zbI-)wH`d-!Fl5H7e8E6?`>1P>idEGL_ zG|e>CG~L9Qaed9KGDnyr&3I1Q9B1xijyEUZlIsFXjb({tk!6`>p=G{hsb#Tcxn-SY zjb)Q%gJp|ly=ARsvt^@YtHq%vYC%n_73$fhIVN1w@N=p;ZAqNqUmWL-nh(b`}oi9({Mqcea>R3r)k9$T%=k;uim09}B8&*%jmr}yYm^+cDhcj+CvLcLpGqW9<>dLh^uoEF3d z)durHe6T{#>T82|Jp`rcJwX}z0)1Ujk-k`8s;|{M^#qT|Q^BC8^h7V{xez`iEhIH0 zJ)|xKLOmf|C<*n1a$$TJ7Y^ZkxF;MU=m;u;iy#pY>4~U~pdz`*)JQ&(M0z6YB5NZ_ z8&4ZgTY{_0w2?6?jcOxjBu0nPW2`ko)Hc(0TvZJ=w=uUh_p#(y`dV@=WtMWwT+2KQ zMAOksv?rE|Rz$PWwXt=v`(pRU9*C`vJs3-(9nr4n?_z~$XLLdIq1eN*M`Dl0ejj@* z_INBNRE#2qjY-A*l+2i(F}-8@#&B`HV*12n$MA8facObsaT#%$aanN#VqT9K z9MdCiV9cPHoS2?*z2bVu^@-~nmmSwH4lkOGCrL$dR05r#NKnQX;NGgdSjc7anIzMb zS(jOx30Yhg$?{~?WkF9454k&fLa(}>ie5}Ft{2~n^b&e`de!#w^seoVhhlqkz4_jC zz4!Gdy@lS6-p=08hw4N3QS^ZvZcyr=^g)?8`Rz5R&!Fr<{Ra&kG-y!HATr1?$Ti3_ zs1^_1QiHj{e9Lip&*0j@B*!xZa_L+qSDCBM^~?3o4a^P7)#rxh8gjYZ)ZFxz6Q!Qq z+FTey4dI6HL&y+e2n?l$(nA$PxuIM|Y6YqARMb{LB~{5+a+PV7q*AE#RHBU8Sb%Z3 z-u3u3fQJ#`IRQEP5QD!VIQcrA+$Xs~uQ!AQ1_d_i_5LCL4RzY&@f>1H+EY};#!qK6HOGUd@xG@lxU`n(CU13fH-W>ZZ0 zl!AWxmqYu>cJyoRyZ}R*hVgVWG``9H!2#GaolDt7is4oFV$Dh#c2qzFc$y#d$hvC&HDO#@rsTDQbv)eVonPG=;r z_m$9^RZ0eLh*28gRj{J+IxR(dDT^)#n^-3)a5&?om`tY7cwYrlaHi1!l7dJK)z9?5d~MhrCEXu}0; zRs@wj8ZxZL>vVLdmAU}dpfp-lu-N`AbTl9sm5^n%TaB5V(vuIY=Q?f8P#Q!U1478MOhI;Ag9Ob>=~*f8FGjwO1HSB zBz~L}B$u2u9^jPrtV~eCHK@5x8*K)Wkz$n5_4a_pj28?@?P6QG7zKcDuz16RGTKYA z#sXlV9`J>HF@o)PU!^njv#!MiXq{39eTY89hB=nn*u6?sp}|_YYO}J}=`D+G*8EI1EBau@a0yFmU8-bN*Xb-}LIa8!CX}(!Y+zC)oHOJb zkpNJaqGT=duV<{uB-yE(G4npvv;fQfo%);MxC*dBh zHA|_=w23fQYI6;|NDSPx>ok`kr@tt`7!usY6F4`dvZ4r^*4QJVhX#ohqBz?-)%e zL!c3aY-5WtSw-9!{{)2N{=V?I1b-bGH;Ky!GDZ6QgM>r9RAgI z^CkJ|W&|oS&KGktAYqlSz0nr|zPyH*#uyv|F7x;iZHmK!z4{yU+6kE{WUMy1u^r&% zjZsSUFa}Ynlyo9>0Q^VFv?_vxgu!3O<(HUUSi zrw}Z*^69}hKxBL*Th#j)dw7nHVf~)_>q8QrTZ8pobT_EswqRF6FNQTFfRt^t##`86 zX`mq;Dc%fH4kV29(Ncu34Yn7xFC3a^pP>nKO)6gmTHB*Zwn^1peO)C_a5*D6eVi`= z+nI4uvP4`=j-^;F2uQYL*(MlU!+*=vV5ItxWQk^^Xp0oiwG_#i!F9sJwVgosQG!UnnP8L{kn|vF zy3uK*PZQe@d@QFEZN6xwI1ceGbr4m`rVzUnF%s#)-%kQR zBDE_dk^u}jT1a3h5ls!oMx&I82(M{qV{b%PqX<$QR#<}q8dOjVQP8M>Mitb7N$e(( zwHQ?(_QN0sErP2ixJrqyEjF?sS#bDejX1a>aZ0*`BT~2sO_UfT=a`gAfh#$Kq$dWk ztCVPujc!sKo2+amSjq5wc}xy7X4;ial;=L>k-}n;T6!bOK_`V;?WJch$$0LJ6llbl zwFEUk&sdQ;BKDAYF`*$=WE*2WE2TEWMYv9jWNuS9NG7lb8>7XvOew61M#e=7^eRS9 z69Xl`;bX;iQos?>UvBR*b#?Np&e)s$uj6oQWkm|9G&&23G`aOyB(K&+DcFO^$&}g@ zs=R;+jAdq4n2G#Bq5V1?o1;4*k|fE3Wl~uU;#&<7jS(_0gUtt!OF}jSsV`_L*pTl- zwgFpbj))Cd?2g`2draCo0;6SBVhHP{CF2qmJN!N%lglo#WlB~Y88IW%L{{QG_c6Dl zB?_drI7Z8vnI_Vhl9o%B3`TDtsOnW%3Xwk`r`T=@rvxk1vltbYVzKNNQG_m7G^Na9 ziewG)7q(=Nl~rL=mRi{gIoa<%GCX27vX@N(J{aZGh^#?!>czj^7y;9;lE|xK@qTG& zGUmv+?2%fz*sBsNOp>ryoS!5K>pfC9CTCBUvgA}TUxmoWN-_1*#=K|H$=SslAEW>x zX+=kjjHxEwSn+Ks&8}pxC3uEkWyP)*1EUnN|5HlSKSrW)Ws4?>5*G}65B7rvBr;1> zv0@l9prSG#{RKvJe=WUBB$ksXk3<`FR>OF)>Xg@N^dhzTJ`!K>kiJv0%F|zXY6RDQQx4igGN8uMnRO3GDaEmkoR~8 zyLNO}$nH^)XKcWaRH4NR0#KZ6fBN!&F++_F!TycG{tNy)BgJ^VqfhwCn=r=P5t&h+ zQkgJKR22f^*!f)}%{KbiED%ZGdhlwD^;nmMidTf@NDR-~I)ABhwbePJRidsChSQMpzmdLQ|0qR-La?$dDCJ^RMkeYrJ0 z#;y}psQVH{@X<9s>~wtwV}h9JBS$e_rO}5$DUZ(z$I(YAM<@S@7I18Di{*EID|v1>gVVYR*hBRp(kt)uKhi4sXEgBvT5x?@1_eIZc_Y=?F zvBnk+@MnyqfI}73iULn-oTap(z=-N&RF$Y^p<0LP_CkOkWD`|TTM80U^+%;^PeCXu zBPu&8f+{GAf{##rh3Xqrm8edmI*;l$D$Yc~I8>FW)}q>m$|FCUDG+64p&%fd!fp}6 zqPmSrv{LXG71%IcRJT!8#$Z0?0ohsn!T@wI?$j zC1jp+x==27$|8c>R6UiP9;~6+5X<4H2(=obwAv~SD4_!%<>Z#C$#hal_+3J&+Y+S- zEeEP#y08s}SUBARKUkPs%ukxS$2m{1pLz!rggXhue#-NICk0kmKe+jSB;{2ui~LJV zC#fG`PAEW;s%1(Pncf8@VlN`6tQ$W$^rA{|@5yhkmlMe|c zj&-iJ6L&i1xHa2K)=%QsmS=i4_P96C{?%ti^94RnMW(sV3hOIi8(Hj{Rl3T#wsaAx zL!qa_sur22WTl00H;e53I+GqbuFL`yZJHM1M9Jg)K*y%?RT%#&6fC>Tv9PpC*ydPU zRxbSHR?DJHi>EoCBZK>)jJ{sQ-ApQ+Eu5GL*Gs(Rcvk~=KSqP+5xDZCSQK5l+~}+- zSzXRg>som7ncUJKn$#NAPX5iOVoM$N{sAbZ^nzgTvy#}&_7;iZS4fX7B=km%JqlYvi-_}V-4K`117*jPej^2L3rRgj`ibt$5d<6ic19bL(OkftA?pY~K{!tG zROc~u;D11$m(u=DdTqt#X^-*>_9LDGeyVUsMhX51-%dbroy6X${eSVoz5N}G*1+#m ztA#~E_JtLG*+nTSMJS4wtdSE%&!r6SBm7*HkN(D0C%0LS@RCwVN|4lpgmQw<+`N`k z#!%y!O;TgXS!e2{qDN|Sk|Ohi3HMk? zJ%w3cDy$}(i5oYtFcvphu{(J7!1JU*#@Q)XM(dywQblITmCBudmYtTm$82q7A%qR4 z{e$tM!7x@`0mf2&M>TG~JIa)kgqftQgq(>8Dxv)SASf7D(b^QC3|}|l=HoStzYF{e zr>kdX7>U<$6^koi_3`oKBq`-iFDIM8aaltyk#!dx<(KD@rA2G73hbZG`j14^cPfu} zPYA_;JH7ja>vb@l!M@`!Vc}(t>ZwzNQZh-=3Ms!(P3Bc|PFZZYK}p*w6`F&`@iqqc(bs+N5byDRsW;zEH$mfH5U_eEFiZWDBakd)N@X;{V|)`b|l-- zuX%0pi`500t;x{aLbYp)6JQm|c#~`(*&In{u%|EBMV25v@CBrgf+BOZDE*t?O(v0B z*!fooi|~_R902;wMRF1MFxqgw2g!&bJ!v34VuT+13sScUqb{6AU$U3c3d}_y^{j#t z`1{;kRdl76xCQR9i~E6WsU$OTEr=`VCU6B>KS$lnA4|5E%om;%Ei0~=wTo2H&ROIT zsUW{RQ)?VMNre)d;B$wY*hxMjk7CFTQsz1=%mh#fwL!ve;sar+)-@v$`_)vBBWTF=y#*&`p!n$Zd(M?ED&cp5qr_1rgV4w4;9n*D zgMy!(mx%p~Pe>_BDi=rR|@!3jsqp@oZMcrj2skx#|$4KZpSr&TQB^8Wu4yH z#T})|LxFoJJR$dl-w5w7@RXKtvyeWk$Pa{HM0g4?aLyVO>|BjPozrtGj|=vcClQIl zFpvd0x7W7_bj}ubbG3#1ShCBRak=njkOSmiCR|7xMfhzbZ750gVN2|pO16^JcL-lj z_L0}!WQEHsTyWUOgprJUB(0WAC7hcyktu?G5V8U~q4#-`I>M2DjM)1x6Vhj?iT#sY zp$F?|p)C8K%VYwxC-^i)_Jm&r>~i*DuR_@qSz(5|+>y3_=-$2d0nPRy&HO0gy8R0c znfY7*yk$6FYVWJ~_cGV*My-&Y;(F-nwO* zc=CRgTKcvcq^Sy$(SvZ49Nb2-!ol4myMPvWi;#ImNDEU4X$;{G;6;WE;a|pa-N~)i z2(txb2s}dCPQmTydj$u;sRF->*gtUQ>)dXrtF_02JlJ=U4qypJS4ic0MC}XJvxEsReiE{~7 zLi!znTd64ElZCXz!){`ZX!gGYFQRY0i)3y6Agefp;KY?E<*gt%Cn4hYj%yB6i7FF^a|o)2Hu0CC_Ry_!8;)ZOLqZ?4tV3!`kv3X0%1j zQlSdSEabw0tU`j#{>GX0me6w+vay?yv**?kZf~oOv|mI7DBMO;Wp=CK<+)m;TQe!j z9i^QvRCJphD5Sqyeu#=thqlp|BNHD$%DcW8)Q0kppf$xE1Qdp;2DKup<8+}!8==vz z(2=D^2sK570@qAZ=~il?TvNQFh+k2xvmbjkPT=PMGf$uv>}SVfoj(OE&;phzzNH|; z%8-J&v)ECcFPJFsqjAvX7Lyqzt*}ZsFLESqvOU7(rYMbqLfK5TE)~~r+ zMS(feyH1h{EKCVW?M|s)Bkp3qtz?&4O)7)RxT}ukZe%i#G1@B1ZjKbVqpc{Cs>Vsp z`qCB129&9UN`DGQz;BOyiwAU5fvj1(R zU&84BQ?198l3$DO2_<;eHz?+>%5<&zZ!0sOYc6xlB|8gRYO`wF%!$Qvbt>HadKdp% z5wBU>e5dr(ic;s+qT+(3MRQJ+%C*IBpi(=8v0)OQnj23Uw!w0Zu*Y#g|_tYu0a`N-Z_l++dmfHE1zvoIC*F9|8 z7oBHx+W*1pb5^Wa(QzeeiMG6$LE}FBaK6=T^**`N-HD51=}W)cp&YTvtU2g${Muo< z>6h2O+wf$<+^E>x)r;NT_8C`p`1(hT+9=2W?dJaNH@b$bs*l^yZcO8nl8A<=b{kf_ z?H~31oVHhAn348XA4}W(fN{yi?4~yU-NRSCdA@g>fY`Ik-amVzb)RE@%=qAi%GT1S zIyNP(TkEhf>*Bu{)6}Z#l`$80|62n5Ed( z8S~3oU+voq?E{~jKRpzm?Gu$B=cC()x0i1mjqaaLgb&A}-`_{2u-~9Rx%}->2ZkwF z!}^LaTuH{o@-hrNkz#8rG5n-HU(K9??@T+RiJ5`#RaZ>;d=|btXJfs4F1}y$(&~}( zF^&ahgLx6gvl!i4NYoF__fY+e^&MoxfQ88Dr|N)An*q>pkA=fCyUAhY-xO3|qLMQ# zJGRAn#aTwXP(gqocjo{nxNupr5Q@MJc;gV1LK&2!=o36;gHQ#NU@}HB73E$`gXu5> zs$nL~LYNJ6P%g?ms6m(y@)vUpVG%5bC9o7>87v3+ljoJN3RWYmfwiy>VLfa>*a(|o zGr|_wim(lDKi&>IU?;*Z*p09U_JRkY7NHLIA?$D2Q>}-C2;adWgu}RUeguvpd=JME zj>8WKc!?vNgnuBMLO2a)5Y8f;gYyVKBK(AK0dH8oh^N{w!DSE;8W0*0t{_~+-4qGe z#JzA0;b#Q-X#5RmLb!?W3&Je~AKXUx72!98I|z3X?jhVq_#NR7ga-%@5gs8tMtFko zCqgqALxTeRwSImYO^Yxc)zhEyUw_Et{e)|ha<3%+WSYgn62^zF$)c11i5D$ON&~PV ze)K{r0H9(>X+H|T4)h;4#-9qoiD!oitEq4R%dHu?R4V}I9#K!Vl}Tt_XI!4`LctHo zxcvDNE{Ar<`Q!yg>!Ff{4eb0W?y%~CM$mO`0X$_Q}r^u?tB?$-+dWMhq)l;!EX4YeK)w& zJRNj1SO`w=f!`aYFsl71IR0%iXpYz*v)@*jJ3IwC-53TtY+r!XbP!$}|113dvI-^* zEP+QOZ$SI?!$AFZISOpaf$@(s;r7arVBB>alJCxhE6dx$-}0(J-P#KU)%j2pIt9T`q)&T?0?g9O!oDJS=r} z1&jFzoGJMd-WX&CXulnP^=l20$1cOXq-Gf2?n9`~&4X2svf$eZ=fIS|6*~W14BowV z@a_K|K1$ZW+bO5OaOo@z>4x3GtVwXv6az7ZKSSe?zEFR-GpMf^K>X$ignRnKowiFM zLVOeALtX%<{vB}kpy1xbH(~X<3DEBPZ_uMx8U&5_2dubw4%Q4yg%9(NfnUrb_(%07 zP%ilm-uiL^EUa@v-m7jX`RprLTlNNwIlCJ=EqNF2?mYtKf)A{#8|7;7l#GiSm6p?GEOfpqA*p$Z`U4xCC`4IO$)@Z>bM{5_AM-ISy7@v&PF z()}LX{FT7QYy05fA2BeQodUI=bcc8pJfh9G18)6nSZN#&@tfyC)}%TZ-#G#N2akeJ zmsY~aYwaQF$Tax7p%?IfZ-l#-i{a-f)1lGpg6gE{;QnPKer=u%JD&tXkC~fb#G;Sj zlTTBj{O!&#FKip^k~C1B6b-+B{xT%8Z6Ls(!uzJ)hqzlqAZtY>e146F-DfQD`!`Eq zbdOJAp1}tbr!0X@Rrle<>jU7p-)~@?(FN}H{uVa8`#xOkJ`A|G6;Mz-0R|830584g zfl=pzpmUGT@MfPcAp4V3kTGa9Xf?Ia@!kgzI{Y-)RCC~Mrax@z_7mI~djN_aghS7f z-#}a24w&{q2dF=a15@ZAsBHWY+~TqWzV#ZYFL#5mmtx^9QUh<0$+#ps33NZ7 zgOA8s_^G)!UOJCskx9?53H)%iAukH=mhZn=rm%az@@?=kzVM5p*$chTAJzLBITEaI$tWXj63X=2zc? z`N3EiUyAaY!#{=kC9lJn(T(71!VlYf4T1eXZiN-Ycfi==$KeFs7S{jT3CgNbK*DMi zn%(0^`2Fn~s3&(})$IhhcylJCytNB{xHJkX54MMnKW%}9(XRlkoe8U7pA1`a8R*by z6Z9tE!jGz@Fm^>Cj2}854Em06VQVLNC_RDVpZcrDk|5idj1-Z#N@wg)6$Ho(D7X%L3I*}Yq3wo!Fu!v$sJAYH8|$%;`aKFNKDY|D<}bk?nYVJT6ZHGO28@fVVdH{- zK*HO8u<1c61pjyhzS;8w%=)PoR)+6}!wUpZfA|)}4-N+#-d#2!^fn&KDMX3P@4+;_ z9E$c_f*+rBgptu(V0`flz~1>2w(p$_?|;}2dUad|{r0~Bo&MMbXWy6scMnd5fWGBm zd}RqN${hxwDeFdN77T9aQ2YvJLLPXU_C|kD*Hh6x30fT!$yGMaA z_0xT@P}vPU+>4;RFdoE=qmbR_B-BTfNe-U(eaviRnxdW!J55t(M z7eOr^fabI1F#5wrSofqJCaY`V>$g9Lk*hbr_oL@P_fN+|eej3y`|;(_;j_!I`Opqz zM+ZRTh5-0{2Oh5Y#txsKD}jKpI1nQI;oIRTAG(79=8YQ*PoC_7oD3hF$Fck7`4A}G zu^skLe+)^>Z1C&oeK6%fGMrnM1Dlp@hT}&AL0{Yn#^k;LaXH0Mee4RHF>Z&Ee_H|F zJI;pSVMpPKwih(qeFPJ`je^F)IJkbw1&=o^2j8s|5dY#KNO(C9x<;i#>+|1%@YoL? z_4*JJ+MI*eH@P6Yx(o)HjzY)57r;}02DFjWpw-9Q;Df2}f%OeLqzt?T6Y%n-yPJdI z@sWG*!mduJZo$uQABBs5v%`pqvtUve9~=tb26;nfK|}5?7~rgjbKQgB;wL?zQ=5yh zHex#5Mohi{gMVHD4r^C9d~FsC z2v`KwUDm_$vw`pd+XM19+=dD6rFaYVba-$g8KNd_gz=7EFynX>?tEQ<3t5Aq;qzBu zL{lpKIp;F`?bI+BKVlK=STzm?-(LW+ZZq&Z2E)+NxaHlk5MIu5Lh%(ZNOMm?&qo|I z=Uj(2y2Ef_XbDVt7z_WXJpj4`$Kj_p)bAvEV2ME$CU&B)V? z`L-`CjvN4+AFRaPuro02VjdWhX-sn-I2X)^Pk$K&FPD!4$F}7#vNMXlw7rRUMEru2 zn=j$<-N8T&?F-^3xU#tK4x=5)S7* z$r+=^b(Nn@jw{J%LfbnZyeOL@PBLWG@Nd+=`aicnGkNhYqiy&6#pj;SBb80`<16no z+D}e=J{NN5?CwZD9;j<>?r!@(O=KhSOaO-s+n1it1WqgB-O902?(w6&F|MDkBwb&`Kr_5W13GIR>V z(2ZDiH_@WKg1%Q#Rc4@z>k%f8=UAqoscwGu1O6O7YI?jT$J4U5bQ7OxNe=%Q%PGg; fMKuFsz^NEN8yzY1T!khp$Ki*Y`e;{(uTlRCJDh*i literal 0 HcmV?d00001 diff --git a/apps/host-cloudflare/src/quickjs.ts b/apps/host-cloudflare/src/quickjs.ts new file mode 100644 index 000000000..9d84484ed --- /dev/null +++ b/apps/host-cloudflare/src/quickjs.ts @@ -0,0 +1,35 @@ +import { newQuickJSWASMModuleFromVariant, newVariant } from "quickjs-emscripten-core"; +import baseVariant from "@jitl/quickjs-wasmfile-release-sync"; +// Static .wasm import: wrangler/workerd compiles this to a WebAssembly.Module at +// BUILD time. Workers forbid runtime WASM compilation (both fetching the .wasm +// and `WebAssembly.instantiate()` of bytes are blocked), so the engine bytes +// MUST be a pre-compiled module imported like this. The file is vendored into +// src/ (copied from @jitl/quickjs-wasmfile-release-sync) because wrangler's +// CompiledWasm module rule is rooted at the app dir and won't match the +// monorepo-root node_modules path — see scripts/vendor-quickjs-wasm.ts. +import wasmModule from "./quickjs-engine.wasm"; + +import { setQuickJSModule } from "@executor-js/runtime-quickjs"; + +// --------------------------------------------------------------------------- +// QuickJS-on-Workers WASM loading. +// +// The base variant's module loader resolves to the variant package's `workerd` +// build (its `./emscripten-module` export has a `workerd` condition wrangler +// selects) — that build expects the WASM module to be supplied rather than +// fetched/compiled at runtime. `newVariant(base, { wasmModule })` hands it the +// statically-imported, pre-compiled module, and `setQuickJSModule` makes every +// `makeQuickJsExecutor()` reuse it. Preloaded once per isolate. +// --------------------------------------------------------------------------- + +let preloaded: Promise | null = null; + +export const preloadQuickJs = (): Promise => { + if (!preloaded) { + const variant = newVariant(baseVariant, { wasmModule }); + preloaded = newQuickJSWASMModuleFromVariant(variant).then((mod) => { + setQuickJSModule(mod); + }); + } + return preloaded; +}; diff --git a/apps/host-cloudflare/src/wasm.d.ts b/apps/host-cloudflare/src/wasm.d.ts new file mode 100644 index 000000000..1bfd61f61 --- /dev/null +++ b/apps/host-cloudflare/src/wasm.d.ts @@ -0,0 +1,6 @@ +// On Cloudflare Workers, a `.wasm` import resolves to a pre-compiled +// `WebAssembly.Module` (wrangler's built-in CompiledWasm module rule). +declare module "*.wasm" { + const wasmModule: WebAssembly.Module; + export default wasmModule; +} diff --git a/apps/host-cloudflare/src/worker.ts b/apps/host-cloudflare/src/worker.ts new file mode 100644 index 000000000..5b1cbb926 --- /dev/null +++ b/apps/host-cloudflare/src/worker.ts @@ -0,0 +1,26 @@ +import { makeCloudflareApp } from "./app"; +import type { CloudflareEnv } from "./config"; + +// --------------------------------------------------------------------------- +// The Worker fetch entry. `ExecutorApp.make`'s `toWebHandler()` produces a +// `(Request) => Promise` — exactly a Worker handler — so the entry is +// thin: build the app ONCE per isolate (memoized; the build runs the D1 schema +// bring-up), then forward every request to its handler. `env` (the D1 binding + +// Access vars) arrives with the request and is captured at build time. +// --------------------------------------------------------------------------- + +let handlerPromise: Promise<(request: Request) => Promise> | null = null; + +const resolveHandler = (env: CloudflareEnv): Promise<(request: Request) => Promise> => { + if (!handlerPromise) { + handlerPromise = makeCloudflareApp(env).then(({ toWebHandler }) => toWebHandler().handler); + } + return handlerPromise; +}; + +export default { + fetch: async (request: Request, env: CloudflareEnv): Promise => { + const serve = await resolveHandler(env); + return serve(request); + }, +}; diff --git a/apps/host-cloudflare/tsconfig.json b/apps/host-cloudflare/tsconfig.json new file mode 100644 index 000000000..f659f662d --- /dev/null +++ b/apps/host-cloudflare/tsconfig.json @@ -0,0 +1,25 @@ +{ + "compilerOptions": { + "target": "ESNext", + "module": "ESNext", + "moduleResolution": "bundler", + "strict": true, + "esModuleInterop": true, + "skipLibCheck": true, + "lib": ["ESNext", "DOM", "DOM.Iterable"], + "types": ["@cloudflare/workers-types", "node"], + "noUnusedLocals": true, + "noImplicitOverride": true, + "plugins": [ + { + "name": "@effect/language-service", + "ignoreEffectSuggestionsInTscExitCode": true, + "ignoreEffectWarningsInTscExitCode": true, + "diagnosticSeverity": { + "preferSchemaOverJson": "off" + } + } + ] + }, + "include": ["src/**/*.ts"] +} diff --git a/apps/host-cloudflare/vite.config.ts b/apps/host-cloudflare/vite.config.ts new file mode 100644 index 000000000..dc371ef79 --- /dev/null +++ b/apps/host-cloudflare/vite.config.ts @@ -0,0 +1,57 @@ +import { fileURLToPath } from "node:url"; + +import { defineConfig } from "vite"; +import react from "@vitejs/plugin-react"; +import tailwindcss from "@tailwindcss/vite"; +import { tanstackRouter } from "@tanstack/router-plugin/vite"; +import executorVitePlugin from "@executor-js/vite-plugin"; + +// --------------------------------------------------------------------------- +// Cloudflare web SPA. The SAME shared @executor-js/react shell + pages as cloud +// and self-host; the TanStack router codegen points at THIS app's routes +// (web/routes) so we get the multiplayer shell with the Cloudflare-Access root +// (no in-app login). `vite build` emits a static bundle to ./dist, which +// wrangler serves via Workers Static Assets (see wrangler.jsonc `assets`). +// `executorVitePlugin` feeds plugin client bundles from executor.config.ts into +// `virtual:executor/plugins-client`. +// +// No dev /api middleware here (self-host forwards to an in-process Bun handler); +// on Cloudflare you run `wrangler dev`, which serves the built SPA + the Worker +// API together. +// --------------------------------------------------------------------------- + +const APP_ROOT = fileURLToPath(new URL("../../packages/app/", import.meta.url)); + +export default defineConfig({ + root: fileURLToPath(new URL("./web/", import.meta.url)), + publicDir: fileURLToPath(new URL("../../packages/app/public/", import.meta.url)), + build: { + outDir: fileURLToPath(new URL("./dist/", import.meta.url)), + emptyOutDir: true, + }, + resolve: { + alias: { "@executor-app": APP_ROOT }, + dedupe: ["react", "react-dom"], + }, + define: { + "import.meta.env.VITE_APP_VERSION": JSON.stringify("0.0.0-cloudflare"), + "import.meta.env.VITE_GITHUB_URL": JSON.stringify("https://github.com/RhysSullivan/executor"), + "process.env.NODE_ENV": JSON.stringify(process.env.NODE_ENV ?? "production"), + }, + server: { + fs: { allow: [fileURLToPath(new URL("../../", import.meta.url))] }, + }, + plugins: [ + tailwindcss(), + executorVitePlugin({ + configPath: fileURLToPath(new URL("./executor.config.ts", import.meta.url)), + }), + tanstackRouter({ + target: "react", + autoCodeSplitting: true, + routesDirectory: fileURLToPath(new URL("./web/routes", import.meta.url)), + generatedRouteTree: fileURLToPath(new URL("./web/routeTree.gen.ts", import.meta.url)), + }), + ...react(), + ], +}); diff --git a/apps/host-cloudflare/web/entry-client.tsx b/apps/host-cloudflare/web/entry-client.tsx new file mode 100644 index 000000000..7041999ed --- /dev/null +++ b/apps/host-cloudflare/web/entry-client.tsx @@ -0,0 +1,16 @@ +import ReactDOM from "react-dom/client"; +import { RouterProvider } from "@tanstack/react-router"; + +import "@executor-js/react/globals.css"; + +import { getRouter } from "./router"; + +// The whole app — shell, pages, and the multiplayer surface — is the shared +// @executor-js/react composition wired in routes/__root.tsx. Cloudflare Access +// is the identity (validated at the edge), so there is no login screen. +const router = getRouter(); +const rootElement = document.getElementById("root"); + +if (rootElement) { + ReactDOM.createRoot(rootElement).render(); +} diff --git a/apps/host-cloudflare/web/index.html b/apps/host-cloudflare/web/index.html new file mode 100644 index 000000000..820aac5e7 --- /dev/null +++ b/apps/host-cloudflare/web/index.html @@ -0,0 +1,22 @@ + + + + + + + + + + Executor + + + + + +

+ + + diff --git a/apps/host-cloudflare/web/routeTree.gen.ts b/apps/host-cloudflare/web/routeTree.gen.ts new file mode 100644 index 000000000..706fc9d11 --- /dev/null +++ b/apps/host-cloudflare/web/routeTree.gen.ts @@ -0,0 +1,231 @@ +/* eslint-disable */ + +// @ts-nocheck + +// noinspection JSUnusedGlobalSymbols + +// This file was automatically generated by TanStack Router. +// You should NOT make any changes in this file as it will be overwritten. +// Additionally, you should also exclude this file from your linter and/or formatter to prevent it from being checked or modified. + +import { Route as rootRouteImport } from './routes/__root' +import { Route as ToolsRouteImport } from './routes/tools' +import { Route as SecretsRouteImport } from './routes/secrets' +import { Route as PoliciesRouteImport } from './routes/policies' +import { Route as ConnectionsRouteImport } from './routes/connections' +import { Route as IndexRouteImport } from './routes/index' +import { Route as SourcesNamespaceRouteImport } from './routes/sources.$namespace' +import { Route as ResumeExecutionIdRouteImport } from './routes/resume.$executionId' +import { Route as SourcesAddPluginKeyRouteImport } from './routes/sources.add.$pluginKey' +import { Route as PluginsPluginIdSplatRouteImport } from './routes/plugins.$pluginId.$' + +const ToolsRoute = ToolsRouteImport.update({ + id: '/tools', + path: '/tools', + getParentRoute: () => rootRouteImport, +} as any) +const SecretsRoute = SecretsRouteImport.update({ + id: '/secrets', + path: '/secrets', + getParentRoute: () => rootRouteImport, +} as any) +const PoliciesRoute = PoliciesRouteImport.update({ + id: '/policies', + path: '/policies', + getParentRoute: () => rootRouteImport, +} as any) +const ConnectionsRoute = ConnectionsRouteImport.update({ + id: '/connections', + path: '/connections', + getParentRoute: () => rootRouteImport, +} as any) +const IndexRoute = IndexRouteImport.update({ + id: '/', + path: '/', + getParentRoute: () => rootRouteImport, +} as any) +const SourcesNamespaceRoute = SourcesNamespaceRouteImport.update({ + id: '/sources/$namespace', + path: '/sources/$namespace', + getParentRoute: () => rootRouteImport, +} as any) +const ResumeExecutionIdRoute = ResumeExecutionIdRouteImport.update({ + id: '/resume/$executionId', + path: '/resume/$executionId', + getParentRoute: () => rootRouteImport, +} as any) +const SourcesAddPluginKeyRoute = SourcesAddPluginKeyRouteImport.update({ + id: '/sources/add/$pluginKey', + path: '/sources/add/$pluginKey', + getParentRoute: () => rootRouteImport, +} as any) +const PluginsPluginIdSplatRoute = PluginsPluginIdSplatRouteImport.update({ + id: '/plugins/$pluginId/$', + path: '/plugins/$pluginId/$', + getParentRoute: () => rootRouteImport, +} as any) + +export interface FileRoutesByFullPath { + '/': typeof IndexRoute + '/connections': typeof ConnectionsRoute + '/policies': typeof PoliciesRoute + '/secrets': typeof SecretsRoute + '/tools': typeof ToolsRoute + '/resume/$executionId': typeof ResumeExecutionIdRoute + '/sources/$namespace': typeof SourcesNamespaceRoute + '/plugins/$pluginId/$': typeof PluginsPluginIdSplatRoute + '/sources/add/$pluginKey': typeof SourcesAddPluginKeyRoute +} +export interface FileRoutesByTo { + '/': typeof IndexRoute + '/connections': typeof ConnectionsRoute + '/policies': typeof PoliciesRoute + '/secrets': typeof SecretsRoute + '/tools': typeof ToolsRoute + '/resume/$executionId': typeof ResumeExecutionIdRoute + '/sources/$namespace': typeof SourcesNamespaceRoute + '/plugins/$pluginId/$': typeof PluginsPluginIdSplatRoute + '/sources/add/$pluginKey': typeof SourcesAddPluginKeyRoute +} +export interface FileRoutesById { + __root__: typeof rootRouteImport + '/': typeof IndexRoute + '/connections': typeof ConnectionsRoute + '/policies': typeof PoliciesRoute + '/secrets': typeof SecretsRoute + '/tools': typeof ToolsRoute + '/resume/$executionId': typeof ResumeExecutionIdRoute + '/sources/$namespace': typeof SourcesNamespaceRoute + '/plugins/$pluginId/$': typeof PluginsPluginIdSplatRoute + '/sources/add/$pluginKey': typeof SourcesAddPluginKeyRoute +} +export interface FileRouteTypes { + fileRoutesByFullPath: FileRoutesByFullPath + fullPaths: + | '/' + | '/connections' + | '/policies' + | '/secrets' + | '/tools' + | '/resume/$executionId' + | '/sources/$namespace' + | '/plugins/$pluginId/$' + | '/sources/add/$pluginKey' + fileRoutesByTo: FileRoutesByTo + to: + | '/' + | '/connections' + | '/policies' + | '/secrets' + | '/tools' + | '/resume/$executionId' + | '/sources/$namespace' + | '/plugins/$pluginId/$' + | '/sources/add/$pluginKey' + id: + | '__root__' + | '/' + | '/connections' + | '/policies' + | '/secrets' + | '/tools' + | '/resume/$executionId' + | '/sources/$namespace' + | '/plugins/$pluginId/$' + | '/sources/add/$pluginKey' + fileRoutesById: FileRoutesById +} +export interface RootRouteChildren { + IndexRoute: typeof IndexRoute + ConnectionsRoute: typeof ConnectionsRoute + PoliciesRoute: typeof PoliciesRoute + SecretsRoute: typeof SecretsRoute + ToolsRoute: typeof ToolsRoute + ResumeExecutionIdRoute: typeof ResumeExecutionIdRoute + SourcesNamespaceRoute: typeof SourcesNamespaceRoute + PluginsPluginIdSplatRoute: typeof PluginsPluginIdSplatRoute + SourcesAddPluginKeyRoute: typeof SourcesAddPluginKeyRoute +} + +declare module '@tanstack/react-router' { + interface FileRoutesByPath { + '/tools': { + id: '/tools' + path: '/tools' + fullPath: '/tools' + preLoaderRoute: typeof ToolsRouteImport + parentRoute: typeof rootRouteImport + } + '/secrets': { + id: '/secrets' + path: '/secrets' + fullPath: '/secrets' + preLoaderRoute: typeof SecretsRouteImport + parentRoute: typeof rootRouteImport + } + '/policies': { + id: '/policies' + path: '/policies' + fullPath: '/policies' + preLoaderRoute: typeof PoliciesRouteImport + parentRoute: typeof rootRouteImport + } + '/connections': { + id: '/connections' + path: '/connections' + fullPath: '/connections' + preLoaderRoute: typeof ConnectionsRouteImport + parentRoute: typeof rootRouteImport + } + '/': { + id: '/' + path: '/' + fullPath: '/' + preLoaderRoute: typeof IndexRouteImport + parentRoute: typeof rootRouteImport + } + '/sources/$namespace': { + id: '/sources/$namespace' + path: '/sources/$namespace' + fullPath: '/sources/$namespace' + preLoaderRoute: typeof SourcesNamespaceRouteImport + parentRoute: typeof rootRouteImport + } + '/resume/$executionId': { + id: '/resume/$executionId' + path: '/resume/$executionId' + fullPath: '/resume/$executionId' + preLoaderRoute: typeof ResumeExecutionIdRouteImport + parentRoute: typeof rootRouteImport + } + '/sources/add/$pluginKey': { + id: '/sources/add/$pluginKey' + path: '/sources/add/$pluginKey' + fullPath: '/sources/add/$pluginKey' + preLoaderRoute: typeof SourcesAddPluginKeyRouteImport + parentRoute: typeof rootRouteImport + } + '/plugins/$pluginId/$': { + id: '/plugins/$pluginId/$' + path: '/plugins/$pluginId/$' + fullPath: '/plugins/$pluginId/$' + preLoaderRoute: typeof PluginsPluginIdSplatRouteImport + parentRoute: typeof rootRouteImport + } + } +} + +const rootRouteChildren: RootRouteChildren = { + IndexRoute: IndexRoute, + ConnectionsRoute: ConnectionsRoute, + PoliciesRoute: PoliciesRoute, + SecretsRoute: SecretsRoute, + ToolsRoute: ToolsRoute, + ResumeExecutionIdRoute: ResumeExecutionIdRoute, + SourcesNamespaceRoute: SourcesNamespaceRoute, + PluginsPluginIdSplatRoute: PluginsPluginIdSplatRoute, + SourcesAddPluginKeyRoute: SourcesAddPluginKeyRoute, +} +export const routeTree = rootRouteImport + ._addFileChildren(rootRouteChildren) + ._addFileTypes() diff --git a/apps/host-cloudflare/web/router.tsx b/apps/host-cloudflare/web/router.tsx new file mode 100644 index 000000000..0d1f42651 --- /dev/null +++ b/apps/host-cloudflare/web/router.tsx @@ -0,0 +1,10 @@ +import { createRouter } from "@tanstack/react-router"; + +import { routeTree } from "./routeTree.gen"; + +export const getRouter = () => + createRouter({ + routeTree, + scrollRestoration: true, + defaultPreloadStaleTime: 0, + }); diff --git a/apps/host-cloudflare/web/routes/__root.tsx b/apps/host-cloudflare/web/routes/__root.tsx new file mode 100644 index 000000000..acd51a330 --- /dev/null +++ b/apps/host-cloudflare/web/routes/__root.tsx @@ -0,0 +1,72 @@ +import { createRootRoute } from "@tanstack/react-router"; +import { useEffect, type ReactNode } from "react"; + +import { ExecutorProvider } from "@executor-js/react/api/provider"; +import { ExecutorPluginsProvider } from "@executor-js/sdk/client"; +import { Toaster } from "@executor-js/react/components/sonner"; +import { AuthProvider, useAuth } from "@executor-js/react/multiplayer/auth-context"; +import { Shell, defaultShellNavItems } from "@executor-js/react/multiplayer/shell"; +import { plugins as clientPlugins } from "virtual:executor/plugins-client"; + +// --------------------------------------------------------------------------- +// Cloudflare root: the SAME shared multiplayer composition as cloud / self-host +// (AuthProvider → Shell → pages), with Cloudflare Access as the identity. +// +// Access authenticates the human at the edge BEFORE the request reaches the +// Worker, so there is no in-app login or first-run setup. `/account/me` (the +// CF AccountProvider) reflects the Access principal, so the auth gate only ever +// resolves to authenticated; the unauthenticated branch can only happen when +// Access isn't in front yet (or a JWT expired) — we bounce to the Access login. +// +// API keys + members are managed in Cloudflare Access, not in-app, so the +// API-keys footer is hidden (`apiKeysTo={null}`) and the nav is the default set. +// --------------------------------------------------------------------------- + +export const Route = createRootRoute({ + component: RootComponent, +}); + +// Sign-out is a redirect to Access's logout endpoint (it clears the Access +// session cookie); the next request re-prompts the Access login. +const signOut = () => { + window.location.href = "/cdn-cgi/access/logout"; +}; + +const Loading = ({ label }: { label: string }) => ( +
+ {label} +
+); + +function AuthGate({ children }: { children: ReactNode }) { + const auth = useAuth(); + + // Access already authenticated the user at the edge; an unauthenticated state + // means there's no live Access session (gate not configured, or expired) — + // send them through the Access login, which returns to the app with a JWT. + useEffect(() => { + if (auth.status === "unauthenticated") { + window.location.href = "/cdn-cgi/access/login"; + } + }, [auth.status]); + + if (auth.status === "authenticated") return <>{children}; + return ( + + ); +} + +function RootComponent() { + return ( + + + + + + + + + + + ); +} diff --git a/apps/host-cloudflare/web/routes/connections.tsx b/apps/host-cloudflare/web/routes/connections.tsx new file mode 100644 index 000000000..ae9f0af5a --- /dev/null +++ b/apps/host-cloudflare/web/routes/connections.tsx @@ -0,0 +1,6 @@ +import { createFileRoute } from "@tanstack/react-router"; +import { ConnectionsPage } from "@executor-js/react/pages/connections"; + +export const Route = createFileRoute("/connections")({ + component: () => , +}); diff --git a/apps/host-cloudflare/web/routes/index.tsx b/apps/host-cloudflare/web/routes/index.tsx new file mode 100644 index 000000000..01273b87a --- /dev/null +++ b/apps/host-cloudflare/web/routes/index.tsx @@ -0,0 +1,6 @@ +import { createFileRoute } from "@tanstack/react-router"; +import { SourcesPage } from "@executor-js/react/pages/sources"; + +export const Route = createFileRoute("/")({ + component: SourcesPage, +}); diff --git a/apps/host-cloudflare/web/routes/plugins.$pluginId.$.tsx b/apps/host-cloudflare/web/routes/plugins.$pluginId.$.tsx new file mode 100644 index 000000000..472ab9768 --- /dev/null +++ b/apps/host-cloudflare/web/routes/plugins.$pluginId.$.tsx @@ -0,0 +1,43 @@ +import { createFileRoute, notFound } from "@tanstack/react-router"; +import { useClientPlugins } from "@executor-js/sdk/client"; + +// --------------------------------------------------------------------------- +// /plugins// +// +// Mounts pages contributed by client plugins. The host's +// `` (set up at the root) materialises the +// list of `ClientPluginSpec` from `virtual:executor/plugins-client`, +// and this route reads it via `useClientPlugins()` — so adding a +// plugin to `executor.config.ts` is sufficient for its pages to mount +// here, with no per-route imports. +// +// Match logic is intentionally tiny: exact path equality between the URL +// remainder and a `PageDecl.path`, with `""` and `/` treated as the +// same root. Plugins that want parameterized paths can build their own +// in-component routing for now. +// --------------------------------------------------------------------------- + +export const Route = createFileRoute("/plugins/$pluginId/$")({ + component: PluginRouteComponent, +}); + +function normalizePath(input: string): string { + if (!input || input === "/") return "/"; + return input.startsWith("/") ? input : `/${input}`; +} + +function PluginRouteComponent() { + const { pluginId, _splat: rest } = Route.useParams(); + const plugins = useClientPlugins(); + const plugin = plugins.find((p) => p.id === pluginId); + // oxlint-disable-next-line executor/no-try-catch-or-throw -- boundary: TanStack Router represents not-found from components by throwing notFound() + if (!plugin) throw notFound(); + + const target = normalizePath(rest ?? "/"); + const page = plugin.pages?.find((p) => normalizePath(p.path) === target); + // oxlint-disable-next-line executor/no-try-catch-or-throw -- boundary: TanStack Router represents not-found from components by throwing notFound() + if (!page) throw notFound(); + + const Component = page.component; + return ; +} diff --git a/apps/host-cloudflare/web/routes/policies.tsx b/apps/host-cloudflare/web/routes/policies.tsx new file mode 100644 index 000000000..a9de9ff6f --- /dev/null +++ b/apps/host-cloudflare/web/routes/policies.tsx @@ -0,0 +1,6 @@ +import { createFileRoute } from "@tanstack/react-router"; +import { PoliciesPage } from "@executor-js/react/pages/policies"; + +export const Route = createFileRoute("/policies")({ + component: () => , +}); diff --git a/apps/host-cloudflare/web/routes/resume.$executionId.tsx b/apps/host-cloudflare/web/routes/resume.$executionId.tsx new file mode 100644 index 000000000..32a84347b --- /dev/null +++ b/apps/host-cloudflare/web/routes/resume.$executionId.tsx @@ -0,0 +1,117 @@ +import { useCallback } from "react"; +import { useAtomSet, useAtomValue } from "@effect/atom-react"; +import { Data, Effect, Option, Schema } from "effect"; +import * as Atom from "effect/unstable/reactivity/Atom"; +import { createFileRoute } from "@tanstack/react-router"; +import { + ResumeApprovalPage, + ResumeApprovalPageView, +} from "@executor-js/react/pages/resume-approval"; +import { pausedExecutionAtom } from "@executor-js/react/api/atoms"; +import type { ElicitationAction } from "@executor-js/react/components/elicitation-approval"; + +const SearchParams = Schema.toStandardSchemaV1( + Schema.Struct({ + mcp_session_id: Schema.optional(Schema.String), + }), +); +const LocalMcpResumeCompleted = Schema.Struct({ + status: Schema.Literal("completed"), + text: Schema.String, + structured: Schema.Unknown, + isError: Schema.Boolean, +}); +const LocalMcpResumePaused = Schema.Struct({ + status: Schema.Literal("paused"), + text: Schema.String, + structured: Schema.Unknown, +}); +const LocalMcpResumeResult = Schema.Union([LocalMcpResumeCompleted, LocalMcpResumePaused]); +const decodeLocalMcpResumeResult = Schema.decodeUnknownOption(LocalMcpResumeResult); + +class LocalMcpResumeError extends Data.TaggedError("LocalMcpResumeError")<{ + readonly message: string; +}> {} + +type LocalMcpResumeInput = { + readonly mcpSessionId: string; + readonly executionId: string; + readonly action: ElicitationAction; + readonly content?: Record; +}; + +const resumeLocalMcpExecution = Atom.fn()((input) => + Effect.gen(function* () { + const response = yield* Effect.tryPromise({ + try: () => + fetch( + `/api/mcp-sessions/${encodeURIComponent(input.mcpSessionId)}/executions/${encodeURIComponent(input.executionId)}/resume`, + { + method: "POST", + headers: { "content-type": "application/json" }, + body: JSON.stringify( + input.action === "accept" + ? { action: input.action, content: input.content ?? {} } + : { action: input.action }, + ), + }, + ), + catch: () => new LocalMcpResumeError({ message: "Failed to submit approval." }), + }); + + if (!response.ok) { + const body = yield* Effect.tryPromise({ + try: () => response.text(), + catch: () => "", + }).pipe(Effect.orElseSucceed(() => "")); + return yield* new LocalMcpResumeError({ + message: body || `Approval request failed (${response.status}).`, + }); + } + + const body = yield* Effect.tryPromise({ + try: () => response.json(), + catch: () => new LocalMcpResumeError({ message: "Approval response was not valid JSON." }), + }); + const result = decodeLocalMcpResumeResult(body); + if (Option.isNone(result)) { + return yield* new LocalMcpResumeError({ + message: "Approval response had an unexpected shape.", + }); + } + return result.value; + }), +); + +export const Route = createFileRoute("/resume/$executionId")({ + validateSearch: SearchParams, + component: RouteComponent, +}); + +function RouteComponent() { + const { executionId } = Route.useParams(); + const { mcp_session_id: mcpSessionId } = Route.useSearch(); + if (mcpSessionId) { + return ; + } + return ; +} + +function LocalMcpResumeApproval(props: { executionId: string; mcpSessionId: string }) { + const paused = useAtomValue(pausedExecutionAtom(props.executionId)); + const doResume = useAtomSet(resumeLocalMcpExecution, { mode: "promiseExit" }); + const resume = useCallback( + (executionId: string, action: ElicitationAction, content?: Record) => + doResume({ mcpSessionId: props.mcpSessionId, executionId, action, content }), + [doResume, props.mcpSessionId], + ); + + return ( + + ); +} diff --git a/apps/host-cloudflare/web/routes/secrets.tsx b/apps/host-cloudflare/web/routes/secrets.tsx new file mode 100644 index 000000000..cdf46a221 --- /dev/null +++ b/apps/host-cloudflare/web/routes/secrets.tsx @@ -0,0 +1,25 @@ +import { Schema } from "effect"; +import { createFileRoute } from "@tanstack/react-router"; +import { SecretsPage } from "@executor-js/react/pages/secrets"; + +// Query params supported by the agent-facing `secrets.create` static tool: +// it builds a URL like `/secrets?name=…&scope=…&secretId=…` and hands +// it to the user. The page opens the add modal pre-filled when any +// prefill field is present so the user only has to type the value. +const SearchParams = Schema.toStandardSchemaV1( + Schema.Struct({ + name: Schema.optional(Schema.String), + secretId: Schema.optional(Schema.String), + provider: Schema.optional(Schema.String), + scope: Schema.optional(Schema.String), + }), +); + +export const Route = createFileRoute("/secrets")({ + validateSearch: SearchParams, + component: () => { + const { name, secretId, provider, scope } = Route.useSearch(); + const hasPrefill = name != null || secretId != null; + return ; + }, +}); diff --git a/apps/host-cloudflare/web/routes/sources.$namespace.tsx b/apps/host-cloudflare/web/routes/sources.$namespace.tsx new file mode 100644 index 000000000..2bcdcce73 --- /dev/null +++ b/apps/host-cloudflare/web/routes/sources.$namespace.tsx @@ -0,0 +1,9 @@ +import { createFileRoute } from "@tanstack/react-router"; +import { SourceDetailPage } from "@executor-js/react/pages/source-detail"; + +export const Route = createFileRoute("/sources/$namespace")({ + component: () => { + const { namespace } = Route.useParams(); + return ; + }, +}); diff --git a/apps/host-cloudflare/web/routes/sources.add.$pluginKey.tsx b/apps/host-cloudflare/web/routes/sources.add.$pluginKey.tsx new file mode 100644 index 000000000..a1618a00a --- /dev/null +++ b/apps/host-cloudflare/web/routes/sources.add.$pluginKey.tsx @@ -0,0 +1,19 @@ +import { Schema } from "effect"; +import { createFileRoute } from "@tanstack/react-router"; +import { SourcesAddPage } from "@executor-js/react/pages/sources-add"; + +const SearchParams = Schema.toStandardSchemaV1( + Schema.Struct({ + url: Schema.optional(Schema.String), + preset: Schema.optional(Schema.String), + }), +); + +export const Route = createFileRoute("/sources/add/$pluginKey")({ + validateSearch: SearchParams, + component: () => { + const { pluginKey } = Route.useParams(); + const { url, preset } = Route.useSearch(); + return ; + }, +}); diff --git a/apps/host-cloudflare/web/routes/tools.tsx b/apps/host-cloudflare/web/routes/tools.tsx new file mode 100644 index 000000000..25929fd2b --- /dev/null +++ b/apps/host-cloudflare/web/routes/tools.tsx @@ -0,0 +1,6 @@ +import { createFileRoute } from "@tanstack/react-router"; +import { ToolsPage } from "@executor-js/react/pages/tools"; + +export const Route = createFileRoute("/tools")({ + component: ToolsPage, +}); diff --git a/apps/host-cloudflare/wrangler.jsonc b/apps/host-cloudflare/wrangler.jsonc new file mode 100644 index 000000000..1c191c5f4 --- /dev/null +++ b/apps/host-cloudflare/wrangler.jsonc @@ -0,0 +1,52 @@ +{ + "$schema": "node_modules/wrangler/config-schema.json", + "name": "executor-cloudflare", + "compatibility_date": "2025-04-01", + "compatibility_flags": ["nodejs_compat"], + "main": "src/worker.ts", + "observability": { "enabled": true }, + // The web UI (Workers Static Assets) — the shared multiplayer SPA built by + // `vite build` into ./dist. `single-page-application` serves index.html for + // client routes (e.g. /policies); `run_worker_first` forces the API + MCP + // paths to the Worker instead of the SPA fallback. + "assets": { + "directory": "./dist", + "not_found_handling": "single-page-application", + "run_worker_first": ["/api/*", "/mcp", "/mcp/*"], + }, + // D1 is the app's SQLite store (the DbProvider seam). `wrangler deploy` + // auto-provisions it on first deploy; replace database_id after that, or run + // `wrangler d1 create executor` and paste the id here. + "d1_databases": [ + { + "binding": "DB", + "database_name": "executor", + "database_id": "ae748ca1-032c-4427-a1a0-fe39db77d1a9", + }, + ], + // R2 holds oversized values that exceed D1's per-value cap (~1-2MB). The D1 + // handle offloads large bound params to this bucket and stores a pointer in + // the row (apps/host-cloudflare/src/db/r2-blob-offload.ts). `wrangler r2 + // bucket create executor-blobs` provisions it. + "r2_buckets": [ + { + "binding": "BLOBS", + "bucket_name": "executor-blobs", + }, + ], + // Cloudflare Access is the entire auth layer: the Worker validates the + // Cf-Access-Jwt-Assertion JWT against the team JWKS. Set these to your Zero + // Trust team domain + the Access application's AUD tag. EXECUTOR_SECRET_KEY + // (the at-rest secret-encryption key) is a SECRET — set it with + // `wrangler secret put EXECUTOR_SECRET_KEY`, never in vars. + "vars": { + "ACCESS_TEAM_DOMAIN": "your-team.cloudflareaccess.com", + "ACCESS_AUD": "", + "ACCESS_NAME_CLAIM": "name", + "ACCESS_GROUPS_CLAIM": "groups", + "ADMIN_EMAILS": "", + "SELF_HOSTED_ORG_ID": "default", + "SELF_HOSTED_ORG_NAME": "Default", + "VITE_PUBLIC_SITE_URL": "https://localhost", + }, +} diff --git a/apps/host-selfhost/.env.example b/apps/host-selfhost/.env.example new file mode 100644 index 000000000..659751596 --- /dev/null +++ b/apps/host-selfhost/.env.example @@ -0,0 +1,32 @@ +# Self-hosted Executor configuration. Copy to `.env` and uncomment what you need. +# +# Everything here is OPTIONAL. A bare `docker compose up` boots a fully working +# instance and walks you through creating the admin account in the browser. + +# Public URL browsers use to reach this instance. It MUST exactly match the +# address you load in the browser (scheme + host + port), or browser logins are +# rejected. Behind a reverse proxy / TLS, set this to your public https URL. +# EXECUTOR_WEB_BASE_URL=https://executor.example.com + +# --- Session secret ----------------------------------------------------------- +# Generated and persisted under the data volume on first boot if unset. Set this +# to manage it yourself (must be at least 32 characters). Rotating it signs every +# user out. +# BETTER_AUTH_SECRET= + +# --- Headless bootstrap admin (CI / infra-as-code) ---------------------------- +# Set BOTH to pre-create the admin instead of the in-browser first-run setup. +# Leave both unset for the browser setup flow (recommended for most deploys). +# EXECUTOR_BOOTSTRAP_ADMIN_EMAIL=you@example.com +# EXECUTOR_BOOTSTRAP_ADMIN_PASSWORD=change-me-to-something-strong +# EXECUTOR_BOOTSTRAP_ADMIN_NAME=Admin + +# --- Organization ------------------------------------------------------------- +# Display name and slug for the single organization every user belongs to. +# EXECUTOR_ORG_NAME=Default +# EXECUTOR_ORG_SLUG=default + +# --- Sandbox network ---------------------------------------------------------- +# Allow sandboxed code to reach loopback/private network addresses. Off by +# default — adversarial generated code should not reach your internal network. +# EXECUTOR_ALLOW_LOCAL_NETWORK=false diff --git a/apps/host-selfhost/Dockerfile b/apps/host-selfhost/Dockerfile index 609d8534d..435363a2d 100644 --- a/apps/host-selfhost/Dockerfile +++ b/apps/host-selfhost/Dockerfile @@ -10,7 +10,7 @@ # -v executor-data:/data executor-selfhost # # SQLite (libSQL, file:/data/...) lives in /data, QuickJS + MCP run in-process — -# so unlike windmill there's no postgres/worker/proxy to orchestrate. +# so there's no postgres/worker/proxy to orchestrate. # ── Build stage: install the workspace + build the SPA ────────────────────── FROM oven/bun:1 AS build @@ -34,6 +34,9 @@ WORKDIR /app/apps/host-selfhost RUN mkdir -p /data VOLUME ["/data"] EXPOSE 4788 +# Readiness probe against the public /api/health endpoint (a trivial DB ping). +HEALTHCHECK --interval=30s --timeout=5s --start-period=20s --retries=5 \ + CMD bun -e "fetch('http://127.0.0.1:4788/api/health').then(r=>process.exit(r.ok?0:1),()=>process.exit(1))" # serve.ts binds the Effect AppLayer (API + /mcp + /api/auth + /docs) and serves # the built SPA from ./dist — one process. CMD ["bun", "run", "src/serve.ts"] diff --git a/apps/host-selfhost/README.md b/apps/host-selfhost/README.md new file mode 100644 index 000000000..41f997cd8 --- /dev/null +++ b/apps/host-selfhost/README.md @@ -0,0 +1,47 @@ +# Self-hosted Executor + +The single-container, self-hostable Executor server: the typed API, the MCP +server, Better Auth (cookie / bearer / API-key + MCP OAuth), QuickJS code +execution, and the web UI — all in one process over a libSQL (SQLite) file. No +external database, worker, or proxy. + +## Run it + +```bash +# From this directory: +docker compose up -d --build +# then open http://localhost:4788 and create the admin account +``` + +No configuration is required. A fresh instance shows a setup screen; the first +person to create an account becomes the owner. After that, people join via +single-use invite links you mint from the **Admin** page, and self-service +signup is closed. + +See [`.env.example`](./.env.example) for optional settings (most importantly +`EXECUTOR_WEB_BASE_URL` behind a domain / TLS) and the full +[Self-Hosting guide](../../docs/self-hosting/guide.mdx) for first-run, inviting +people, backups, reverse-proxy setup, and upgrades. + +## Develop + +```bash +bun run build # build the SPA (regenerates the route tree) +bun run src/serve.ts # serve the built app +bun run --filter @executor-js/host-selfhost test # the test suite +``` + +## Layout + +``` +src/ + app.ts the ExecutorApp.make composition root + serve.ts the Bun server entry + config.ts env + zero-config secret/key persistence + auth/ Better Auth wiring, the signup gate, invite codes, seed + account/ the AccountProvider seam (members/roles via the org plugin) + admin/ the invite-code admin HttpApi + system/ public /api/health + /api/setup-status + db/ · mcp/ · execution.ts · plugins.ts · observability.ts +web/ the TanStack Router SPA (setup, login, join, admin, …) +``` diff --git a/apps/host-selfhost/docker-compose.yml b/apps/host-selfhost/docker-compose.yml new file mode 100644 index 000000000..ed6cc80de --- /dev/null +++ b/apps/host-selfhost/docker-compose.yml @@ -0,0 +1,42 @@ +# One-command self-hosted Executor. +# +# docker compose up -d --build # build the image and start +# open http://localhost:4788 # create the admin account (first-run) +# +# Everything — SQLite (libSQL), QuickJS code execution, and the MCP server — runs +# in this single container. The named volume persists the database and the +# generated keys across restarts and upgrades. Nothing else to orchestrate. +# +# No configuration is required: a bare `docker compose up` boots a working +# instance and walks you through creating the admin account in the browser. +# Optional settings live in .env (see .env.example) — most importantly +# EXECUTOR_WEB_BASE_URL when serving behind a domain / TLS. + +services: + executor: + build: + # Build context is the repo root: the Bun workspace install needs every member. + context: ../.. + dockerfile: apps/host-selfhost/Dockerfile + image: executor-selfhost + restart: unless-stopped + ports: + - "4788:4788" + env_file: + - path: .env + required: false + volumes: + - executor-data:/data + healthcheck: + test: + - CMD + - bun + - -e + - "fetch('http://127.0.0.1:4788/api/health').then(r=>process.exit(r.ok?0:1),()=>process.exit(1))" + interval: 30s + timeout: 5s + retries: 5 + start_period: 20s + +volumes: + executor-data: diff --git a/apps/host-selfhost/src/admin/api.ts b/apps/host-selfhost/src/admin/api.ts new file mode 100644 index 000000000..449ad2e98 --- /dev/null +++ b/apps/host-selfhost/src/admin/api.ts @@ -0,0 +1,92 @@ +import { HttpApi, HttpApiEndpoint, HttpApiGroup } from "effect/unstable/httpapi"; +import { Schema } from "effect"; + +// --------------------------------------------------------------------------- +// Self-host admin API — the invite-code surface (app-local, self-host only). +// +// Member/role management is the shared, provider-neutral /account/* surface +// (served by the Better Auth AccountProvider, rendered by the shared org page). +// Invite CODES are self-host's join mechanism and have no neutral equivalent — +// cloud joins via WorkOS — so they live in this app-local group, served +// alongside the core API under /api and consumed by a self-host atom client. +// +// Browser-safe: schemas + the HttpApi value only (no server imports), so the +// web client can build a typed AtomHttpApi from it. +// --------------------------------------------------------------------------- + +export class AdminError extends Schema.TaggedErrorClass()( + "AdminError", + { message: Schema.String }, + { httpApiStatus: 500 }, +) {} + +export class AdminUnauthorized extends Schema.TaggedErrorClass()( + "AdminUnauthorized", + {}, + { httpApiStatus: 401 }, +) {} + +export class AdminForbidden extends Schema.TaggedErrorClass()( + "AdminForbidden", + {}, + { httpApiStatus: 403 }, +) {} + +export const InviteCode = Schema.Struct({ + id: Schema.String, + code: Schema.String, + role: Schema.String, + label: Schema.NullOr(Schema.String), + createdAt: Schema.String, + expiresAt: Schema.NullOr(Schema.String), + usedByEmail: Schema.NullOr(Schema.String), + usedAt: Schema.NullOr(Schema.String), +}); + +export const InvitesResponse = Schema.Struct({ + invites: Schema.Array(InviteCode), +}); + +export const CreateInviteBody = Schema.Struct({ + role: Schema.optional(Schema.String), + label: Schema.optional(Schema.String), + expiresInDays: Schema.optional(Schema.NullOr(Schema.Number)), +}); + +export const SuccessResponse = Schema.Struct({ + success: Schema.Boolean, +}); + +const InviteParams = { inviteId: Schema.String }; + +// Paths are `/admin/*` (no `/api`): the server mounts this on the same +// `/api`-prefixed router as the core API, and the client prepends the `/api` +// base — symmetric with the account API. +export const AdminApi = HttpApiGroup.make("admin") + .add( + HttpApiEndpoint.get("listInvites", "/admin/invites", { + success: InvitesResponse, + error: [AdminError, AdminUnauthorized, AdminForbidden], + }), + ) + .add( + HttpApiEndpoint.post("createInvite", "/admin/invites", { + payload: CreateInviteBody, + success: InviteCode, + error: [AdminError, AdminUnauthorized, AdminForbidden], + }), + ) + .add( + HttpApiEndpoint.delete("revokeInvite", "/admin/invites/:inviteId", { + params: InviteParams, + success: SuccessResponse, + error: [AdminError, AdminUnauthorized, AdminForbidden], + }), + ); + +/** + * Standalone HttpApi wrapping the admin group — used to build the self-host + * `AdminApiClient` atoms in the web app, and mounted server-side as an + * extension route layer. + */ +export const AdminHttpApi = HttpApi.make("executor-self-host-admin").add(AdminApi); diff --git a/apps/host-selfhost/src/admin/handlers.ts b/apps/host-selfhost/src/admin/handlers.ts new file mode 100644 index 000000000..592eba2dc --- /dev/null +++ b/apps/host-selfhost/src/admin/handlers.ts @@ -0,0 +1,139 @@ +import { HttpApiBuilder } from "effect/unstable/httpapi"; +import { HttpRouter, HttpServerRequest } from "effect/unstable/http"; +import { Effect, Layer } from "effect"; + +import { + AdminError, + AdminForbidden, + AdminHttpApi, + AdminUnauthorized, + type InviteCode as InviteCodeSchema, +} from "./api"; +import { BetterAuth, type BetterAuthHandle } from "../auth/better-auth"; +import { SelfHostDb, type SelfHostDbHandle } from "../db/self-host-db"; +import { + createInviteCode, + listInviteCodes, + revokeInviteCode, + type InviteCodeRow, + type InviteRole, +} from "../auth/invites"; + +// --------------------------------------------------------------------------- +// Handlers for the self-host admin (invite-code) API. Every Promise-returning +// boundary (Better Auth, the libSQL store) is wrapped in Effect.tryPromise with +// a typed failure — no raw try/catch, no Promise.catch. Each route is gated: +// the caller must be an owner/admin member of the one org (resolved through the +// org primitive's getActiveMember). +// --------------------------------------------------------------------------- + +const requestHeaders = Effect.map( + HttpServerRequest.HttpServerRequest.asEffect(), + (request): Headers => new Headers({ ...request.headers }), +); + +// Resolve + authorize the caller, returning their member record (for userId). +const requireAdmin = (headers: Headers) => + Effect.gen(function* () { + const { auth } = yield* BetterAuth; + const member = yield* Effect.tryPromise({ + try: () => auth.api.getActiveMember({ headers }), + catch: () => new AdminError({ message: "Failed to resolve session" }), + }).pipe(Effect.orElseSucceed(() => null)); + if (!member) return yield* new AdminUnauthorized(); + if (member.role !== "owner" && member.role !== "admin") return yield* new AdminForbidden(); + return member; + }); + +const narrowRole = (role: string | undefined): InviteRole => + role === "admin" ? "admin" : "member"; + +// Drop the internal audit columns (createdBy/usedBy) for the wire shape. +const toWire = (row: InviteCodeRow): typeof InviteCodeSchema.Type => ({ + id: row.id, + code: row.code, + role: row.role, + label: row.label, + createdAt: row.createdAt, + expiresAt: row.expiresAt, + usedByEmail: row.usedByEmail, + usedAt: row.usedAt, +}); + +export const AdminHandlers = HttpApiBuilder.group(AdminHttpApi, "admin", (handlers) => + handlers + .handle("listInvites", () => + Effect.gen(function* () { + yield* requireAdmin(yield* requestHeaders); + const { client } = yield* SelfHostDb; + const rows = yield* Effect.tryPromise({ + try: () => listInviteCodes(client), + catch: () => new AdminError({ message: "Failed to list invites" }), + }); + return { invites: rows.map(toWire) }; + }), + ) + .handle("createInvite", ({ payload }) => + Effect.gen(function* () { + const member = yield* requireAdmin(yield* requestHeaders); + const { client } = yield* SelfHostDb; + const days = payload.expiresInDays ?? null; + const expiresAt = + days && days > 0 ? new Date(Date.now() + days * 86_400_000).toISOString() : null; + const row = yield* Effect.tryPromise({ + try: () => + createInviteCode(client, { + createdBy: member.userId, + role: narrowRole(payload.role), + label: payload.label?.trim() ? payload.label.trim() : null, + expiresAt, + }), + catch: () => new AdminError({ message: "Failed to create invite" }), + }); + return toWire(row); + }), + ) + .handle("revokeInvite", ({ params }) => + Effect.gen(function* () { + yield* requireAdmin(yield* requestHeaders); + const { client } = yield* SelfHostDb; + yield* Effect.tryPromise({ + try: () => revokeInviteCode(client, params.inviteId), + catch: () => new AdminError({ message: "Failed to revoke invite" }), + }); + return { success: true }; + }), + ), +); + +export interface SelfHostAdminApiDeps { + readonly betterAuth: BetterAuthHandle; + readonly db: SelfHostDbHandle; + readonly mountPrefix: `/${string}`; +} + +/** + * The mountable extension route layer: registers the admin routes on the + * `mountPrefix`-prefixed view of the ambient router (so `/admin/*` is served at + * `/api/admin/*`). Better Auth + the DB handle are app singletons, provided via + * `provideRequest` so the handlers' per-request requirement markers are cleared + * (a plain `Layer.provide` leaves them on the layer's requirement channel). The + * residual platform/router requirements are cleared by the serve binding — the + * loose `RouteExtension` channel the app's `extensions.routes` accepts. + */ +export const makeSelfHostAdminApiLayer = ({ + betterAuth, + db, + mountPrefix, +}: SelfHostAdminApiDeps) => { + const prefixedRouter = Layer.effect(HttpRouter.HttpRouter)( + Effect.map(HttpRouter.HttpRouter.asEffect(), (router) => router.prefixed(mountPrefix)), + ); + return HttpApiBuilder.layer(AdminHttpApi).pipe( + Layer.provide(AdminHandlers), + Layer.provide(prefixedRouter), + HttpRouter.provideRequest( + Layer.mergeAll(Layer.succeed(BetterAuth)(betterAuth), Layer.succeed(SelfHostDb)(db)), + ), + ); +}; diff --git a/apps/host-selfhost/src/admin/invites.node.test.ts b/apps/host-selfhost/src/admin/invites.node.test.ts new file mode 100644 index 000000000..1b20f2888 --- /dev/null +++ b/apps/host-selfhost/src/admin/invites.node.test.ts @@ -0,0 +1,75 @@ +import { mkdtempSync } from "node:fs"; +import { tmpdir } from "node:os"; +import { join } from "node:path"; + +import { afterAll, expect, test } from "@effect/vitest"; + +import { mintInviteCode } from "../testing/mint-invite"; + +// Real Better Auth path: signup must be invite-gated. +process.env.EXECUTOR_DATA_DIR = mkdtempSync(join(tmpdir(), "eh-invite-")); +process.env.BETTER_AUTH_SECRET = "invite-test-secret-0123456789-abcdefghij-klmn"; +process.env.EXECUTOR_BOOTSTRAP_ADMIN_EMAIL = "admin@invite.test"; +process.env.EXECUTOR_BOOTSTRAP_ADMIN_PASSWORD = "admin-pass-123456"; + +const { makeSelfHostApiHandler } = await import("../app"); +const { handler, dispose } = await makeSelfHostApiHandler(); +afterAll(() => dispose()); + +const BASE = "http://localhost:4788"; + +const signUp = (body: Record) => + handler( + new Request(`${BASE}/api/auth/sign-up/email`, { + method: "POST", + headers: { "content-type": "application/json" }, + body: JSON.stringify(body), + }), + ); + +test("open signup is closed: a signup without a valid invite code is rejected", async () => { + const res = await signUp({ + email: "intruder@invite.test", + password: "password-12345678", + name: "Intruder", + }); + expect(res.status).not.toBe(200); + + const badCode = await signUp({ + email: "intruder2@invite.test", + password: "password-12345678", + name: "Intruder", + inviteCode: "AAAA-BBBB-CCCC", + }); + expect(badCode.status).not.toBe(200); +}); + +test("a code minted via the admin API redeems into a real org membership", async () => { + // Minted through the TYPED admin HttpApi client (see mint-invite.ts). + const inviteCode = await mintInviteCode(handler); + + const res = await signUp({ + email: "member@invite.test", + password: "password-12345678", + name: "Member", + inviteCode, + }); + expect(res.status).toBe(200); + const token = res.headers.get("set-auth-token") ?? ""; + expect(token).not.toBe(""); + + // The new user resolves to the one org's scope (membership, via the pin). + const scope = await handler( + new Request(`${BASE}/api/scope`, { headers: { authorization: `Bearer ${token}` } }), + ); + expect(scope.status).toBe(200); + + // The single-use code is now spent: reusing it is rejected. + const reuse = await signUp({ + email: "second@invite.test", + password: "password-12345678", + name: "Second", + inviteCode, + }); + expect(reuse.status).not.toBe(200); +}); diff --git a/apps/host-selfhost/src/app.ts b/apps/host-selfhost/src/app.ts index d20816e0c..1401d0685 100644 --- a/apps/host-selfhost/src/app.ts +++ b/apps/host-selfhost/src/app.ts @@ -5,6 +5,8 @@ import { Layer } from "effect"; import { composePluginApi, ExecutorApp, textFailureStrategy } from "@executor-js/api/server"; import { resolveAuthProviders } from "./auth"; +import { makeSelfHostAdminApiLayer } from "./admin/handlers"; +import { makeSelfHostSystemApiLayer } from "./system/handlers"; import { selfHostAccountMiddleware } from "./account"; import { loadConfig, SELF_HOST_NAMESPACE, SELF_HOST_SCHEMA_VERSION } from "./config"; import { createSelfHostDb, SelfHostDb, SelfHostDbProvider } from "./db/self-host-db"; @@ -75,6 +77,10 @@ export const makeSelfHostApp = async (options: MakeSelfHostAppOptions = {}) => { routes: [ // Better Auth owns /api/auth/* — the full path reaches it unmodified. HttpRouter.add("*", "/api/auth/*", HttpEffect.fromWebHandler(authHandler)), + // App-local admin (invite-code) API, served under /api/admin/*. + makeSelfHostAdminApiLayer({ betterAuth, db: dbHandle, mountPrefix: "/api" }), + // Public system API: /api/health + /api/setup-status (unauthenticated). + makeSelfHostSystemApiLayer({ betterAuth, db: dbHandle, mountPrefix: "/api" }), // Swagger UI at /docs, over the /api-prefixed spec (matches the served paths). HttpApiSwagger.layer(composePluginApi(selfHostPlugins).prefix("/api"), { path: "/docs" }), ], diff --git a/apps/host-selfhost/src/auth/better-auth.test.ts b/apps/host-selfhost/src/auth/better-auth.test.ts index 7037a8ab2..beef0c503 100644 --- a/apps/host-selfhost/src/auth/better-auth.test.ts +++ b/apps/host-selfhost/src/auth/better-auth.test.ts @@ -4,6 +4,8 @@ import { join } from "node:path"; import { afterAll, expect, test } from "@effect/vitest"; +import { mintInviteCode } from "../testing/mint-invite"; + // Real Better Auth path: set a secret + bootstrap admin before importing. process.env.EXECUTOR_DATA_DIR = mkdtempSync(join(tmpdir(), "eh-auth-")); process.env.BETTER_AUTH_SECRET = "test-secret-0123456789-abcdefghijklmnop-qrstuv"; @@ -50,6 +52,7 @@ test("migrations create both the Better Auth and FumaDB executor schema regions" }); test("sign-up issues a bearer token and resolves to a per-user org-pinned scope", async () => { + const inviteCode = await mintInviteCode(handler); const signUp = await handler( new Request(`${BASE}/api/auth/sign-up/email`, { method: "POST", @@ -58,6 +61,7 @@ test("sign-up issues a bearer token and resolves to a per-user org-pinned scope" email: "member@test.local", password: "member-password-123", name: "Member", + inviteCode, }), }), ); diff --git a/apps/host-selfhost/src/auth/better-auth.ts b/apps/host-selfhost/src/auth/better-auth.ts index ad7f8886d..578304090 100644 --- a/apps/host-selfhost/src/auth/better-auth.ts +++ b/apps/host-selfhost/src/auth/better-auth.ts @@ -1,4 +1,5 @@ import { betterAuth, type BetterAuthOptions } from "better-auth"; +import { APIError } from "better-auth/api"; import { admin, bearer, mcp, organization } from "better-auth/plugins"; import { apiKey } from "@better-auth/api-key"; import { type Client } from "@libsql/client"; @@ -7,6 +8,22 @@ import { Context } from "effect"; import { loadConfig } from "../config"; import { seedOrgAndAdmin } from "./seed"; +import { consumeInviteCode, ensureInviteCodeTable, findRedeemableCode } from "./invites"; + +// The self-service signup gate: present only on the live (phase-2) auth +// instance, so the bootstrap seed's `createUser` — which +// runs on the gate-free phase-1 instance — is never blocked. `getAuth` is +// late-bound because the hooks call `auth.api.addMember` AFTER the instance they +// belong to is constructed (the closure resolves it at request time). +interface SignupGate { + readonly client: Client; + readonly organizationId: string; + readonly getAuth: () => Auth | null; +} + +// Only self-service email signups are code-gated. Server/admin-initiated user +// creation (the seed, or a future admin "add user") flows through other paths. +const SIGNUP_PATH = "/sign-up/email"; // --------------------------------------------------------------------------- // Better Auth instance over the SAME libSQL `file:` URL as the FumaDB executor @@ -36,12 +53,14 @@ import { seedOrgAndAdmin } from "./seed"; // session/user shapes (activeOrganizationId, role, createUser, ...). // --------------------------------------------------------------------------- -const makeAuthOptions = (url: string, organizationId: string) => { +const makeAuthOptions = (url: string, organizationId: string, gate?: SignupGate) => { const config = loadConfig(); + // Always resolved (generated + persisted when no env is set); this guards only + // an explicitly-set env secret that is too weak. const secret = config.authSecret; - if (!secret || secret.length < 32) { - // oxlint-disable-next-line executor/no-try-catch-or-throw, executor/no-error-constructor -- boundary: a multi-user auth server must not boot without a strong session secret - throw new Error("BETTER_AUTH_SECRET (or AUTH_SECRET) must be set and at least 32 characters"); + if (secret.length < 32) { + // oxlint-disable-next-line executor/no-try-catch-or-throw, executor/no-error-constructor -- boundary: a multi-user auth server must not boot with a weak session secret + throw new Error("BETTER_AUTH_SECRET (or AUTH_SECRET), if set, must be at least 32 characters"); } return { database: { dialect: new LibsqlDialect({ url }), type: "sqlite" as const }, @@ -72,20 +91,103 @@ const makeAuthOptions = (url: string, organizationId: string) => { session: { create: { // Single-org instance: pin every session to the one organization, so - // every authenticated user resolves to the org scope. (Membership - // rows are only created for the bootstrap admin via createOrganization; - // the pin — not a member row — is what scope derivation reads.) + // every authenticated user resolves to the org scope. before: async (session: Record) => ({ data: { ...session, activeOrganizationId: organizationId }, }), }, }, + // The signup gate. First-run: an org with ZERO members is unclaimed, so + // the first signup is admitted ungated and becomes the owner. After that, + // `before` rejects a signup without a valid, unused, unexpired invite code + // and `after` makes the new user a real `member` + burns the code. + ...(gate + ? { + user: { + create: { + before: async (_user, context) => { + if (context?.path !== SIGNUP_PATH) return; + if (await orgHasNoMembers(gate)) return; // first user claims the org + const code = inviteCodeFrom(context); + if (!code) { + // oxlint-disable-next-line executor/no-try-catch-or-throw -- boundary: a Better Auth create hook rejects a request by throwing APIError + throw new APIError("FORBIDDEN", { + message: "An invite code is required to sign up.", + }); + } + if (!(await findRedeemableCode(gate.client, code))) { + // oxlint-disable-next-line executor/no-try-catch-or-throw -- boundary: a Better Auth create hook rejects a request by throwing APIError + throw new APIError("FORBIDDEN", { + message: "That invite code is invalid, already used, or expired.", + }); + } + }, + after: async (user, context) => { + if (context?.path !== SIGNUP_PATH) return; + const auth = gate.getAuth(); + if (!auth) return; + // First user into an empty org becomes its owner (no code). + if (await orgHasNoMembers(gate)) { + await auth.api.addMember({ + body: { userId: user.id, role: "owner", organizationId: gate.organizationId }, + }); + return; + } + const code = inviteCodeFrom(context); + if (!code) return; + const redeemable = await findRedeemableCode(gate.client, code); + if (!redeemable) return; + await auth.api.addMember({ + body: { + userId: user.id, + role: redeemable.role, + organizationId: gate.organizationId, + }, + }); + await consumeInviteCode(gate.client, code, { + usedBy: user.id, + usedByEmail: user.email, + }); + }, + }, + }, + } + : {}), }, } satisfies BetterAuthOptions; }; -const createAuthInstance = (url: string, organizationId: string) => - betterAuth(makeAuthOptions(url, organizationId)); +// The invite code rides on the signup request body (`{ name, email, password, +// inviteCode }`); Better Auth reads the body loosely, so a non-schema field +// survives to the create hook's endpoint context. +const inviteCodeFrom = (context: { body?: unknown }): string | undefined => { + const body = context.body; + if (body && typeof body === "object" && "inviteCode" in body) { + const code = (body as { inviteCode?: unknown }).inviteCode; + if (typeof code === "string" && code.trim().length > 0) return code; + } + return undefined; +}; + +// Count org members via Better Auth's OWN adapter — the SAME connection that +// `addMember` writes through. SelfHostDb opens a SEPARATE libSQL connection +// whose snapshot can lag Better Auth's writes (observed under Bun: a just-added +// member is invisible to that connection for a while), so any membership read +// that gates behaviour MUST go through here to stay consistent with the writes. +export const countOrgMembers = (auth: Auth, organizationId: string): Promise => + auth.$context.then(({ adapter }) => + adapter.count({ model: "member", where: [{ field: "organizationId", value: organizationId }] }), + ); + +// True when the single org has no members yet — the unclaimed first-run state. +const orgHasNoMembers = async (gate: SignupGate): Promise => { + const auth = gate.getAuth(); + if (!auth) return true; + return (await countOrgMembers(auth, gate.organizationId)) === 0; +}; + +const createAuthInstance = (url: string, organizationId: string, gate?: SignupGate) => + betterAuth(makeAuthOptions(url, organizationId, gate)); export type Auth = ReturnType; @@ -114,15 +216,19 @@ export class BetterAuth extends Context.Service()( export const buildBetterAuth = async (url: string, client: Client): Promise => { const config = loadConfig(); - // Phase 1: bootstrap instance (placeholder org), create tables, seed. - // `runMigrations()` flows through the LibsqlDialect and is idempotent. + // Phase 1: bootstrap instance (placeholder org, NO signup gate), create + // tables, seed. `runMigrations()` flows through the LibsqlDialect and is + // idempotent; the gate-free instance lets the seed's `createUser` through. const bootstrap = createAuthInstance(url, ""); await (await bootstrap.$context).runMigrations(); + await ensureInviteCodeTable(client); const { organizationId, organizationName } = await seedOrgAndAdmin(bootstrap, client, config); - // Phase 2: rebuild with the real org id so the session-pin hook is correct. - // Migrations are already applied; this instance opens its own dialect - // connection to the same file. - const auth = createAuthInstance(url, organizationId); + // Phase 2: the live instance — real org id (session pin) + the signup gate. + // `getAuth` resolves to this very instance, so the gate's `after` hook can + // call `auth.api.addMember` once a code is redeemed. + let auth: Auth | null = null; + const gate: SignupGate = { client, organizationId, getAuth: () => auth }; + auth = createAuthInstance(url, organizationId, gate); return { auth, organizationId, organizationName, handler: auth.handler }; }; diff --git a/apps/host-selfhost/src/auth/invites.ts b/apps/host-selfhost/src/auth/invites.ts new file mode 100644 index 000000000..20fdd23c2 --- /dev/null +++ b/apps/host-selfhost/src/auth/invites.ts @@ -0,0 +1,153 @@ +import { randomBytes } from "node:crypto"; + +import type { Client, Row } from "@libsql/client"; + +// --------------------------------------------------------------------------- +// Invite codes — the join mechanism for a single-tenant instance. +// +// The instance closes open signup (the `user.create` gate in better-auth.ts) +// and lets people in ONLY by redeeming a per-user, single-use code. The code is +// the bearer credential: whoever holds it can self-register (with their own +// name/email/password) and lands as a real `member` of the one org. Unlike +// Better Auth's `invitation` table, a code is NOT bound to an email — the admin +// hands out a link, not an address. +// +// Stored in a raw libSQL table managed here (CREATE TABLE IF NOT EXISTS on +// boot), the same hand-rolled-SQL pattern the org/admin seed uses against the +// shared libSQL file. It is intentionally independent of both the fumadb +// versioned schema and Better Auth's migrator. +// --------------------------------------------------------------------------- + +export type InviteRole = "admin" | "member"; + +export interface InviteCodeRow { + readonly id: string; + readonly code: string; + readonly role: InviteRole; + readonly label: string | null; + readonly createdBy: string; + readonly createdAt: string; + readonly expiresAt: string | null; + readonly usedBy: string | null; + readonly usedByEmail: string | null; + readonly usedAt: string | null; +} + +// Unambiguous alphabet (no 0/O/1/I/l) so a code is easy to read and type. +const ALPHABET = "ABCDEFGHJKLMNPQRSTUVWXYZ23456789"; + +// 12 chars grouped as XXXX-XXXX-XXXX — easy to read aloud or paste. +const generateCode = (): string => { + const bytes = randomBytes(12); + const chars = Array.from(bytes, (b) => ALPHABET[b % ALPHABET.length]); + return [chars.slice(0, 4), chars.slice(4, 8), chars.slice(8, 12)] + .map((g) => g.join("")) + .join("-"); +}; + +const toRow = (raw: Row): InviteCodeRow => ({ + id: String(raw.id), + code: String(raw.code), + role: raw.role === "admin" ? "admin" : "member", + label: raw.label == null ? null : String(raw.label), + createdBy: String(raw.created_by), + createdAt: String(raw.created_at), + expiresAt: raw.expires_at == null ? null : String(raw.expires_at), + usedBy: raw.used_by == null ? null : String(raw.used_by), + usedByEmail: raw.used_by_email == null ? null : String(raw.used_by_email), + usedAt: raw.used_at == null ? null : String(raw.used_at), +}); + +export const ensureInviteCodeTable = async (client: Client): Promise => { + await client.execute(` + CREATE TABLE IF NOT EXISTS invite_code ( + id TEXT PRIMARY KEY, + code TEXT NOT NULL UNIQUE, + role TEXT NOT NULL DEFAULT 'member', + label TEXT, + created_by TEXT NOT NULL, + created_at TEXT NOT NULL, + expires_at TEXT, + used_by TEXT, + used_by_email TEXT, + used_at TEXT + ) + `); +}; + +export interface CreateInviteCodeInput { + readonly createdBy: string; + readonly role?: InviteRole; + readonly label?: string | null; + readonly expiresAt?: string | null; +} + +export const createInviteCode = async ( + client: Client, + input: CreateInviteCodeInput, +): Promise => { + const row: InviteCodeRow = { + id: randomBytes(16).toString("hex"), + code: generateCode(), + role: input.role ?? "member", + label: input.label ?? null, + createdBy: input.createdBy, + createdAt: new Date().toISOString(), + expiresAt: input.expiresAt ?? null, + usedBy: null, + usedByEmail: null, + usedAt: null, + }; + await client.execute({ + sql: `INSERT INTO invite_code (id, code, role, label, created_by, created_at, expires_at) + VALUES (?, ?, ?, ?, ?, ?, ?)`, + args: [row.id, row.code, row.role, row.label, row.createdBy, row.createdAt, row.expiresAt], + }); + return row; +}; + +// Newest first; the admin page renders pending + used together. +export const listInviteCodes = async (client: Client): Promise => { + const result = await client.execute("SELECT * FROM invite_code ORDER BY created_at DESC"); + return result.rows.map(toRow); +}; + +// Revoke = delete a pending (unused) code. Used codes are kept as an audit row +// (their membership already exists); deleting one would not remove the member. +export const revokeInviteCode = async (client: Client, id: string): Promise => { + await client.execute({ + sql: "DELETE FROM invite_code WHERE id = ? AND used_at IS NULL", + args: [id], + }); +}; + +// A code is redeemable when it exists, is unused, and is unexpired. +export const findRedeemableCode = async ( + client: Client, + code: string, +): Promise => { + const result = await client.execute({ + sql: "SELECT * FROM invite_code WHERE code = ? AND used_at IS NULL", + args: [code.trim().toUpperCase()], + }); + const raw = result.rows[0]; + if (!raw) return null; + const row = toRow(raw); + if (row.expiresAt && Date.parse(row.expiresAt) < Date.now()) return null; + return row; +}; + +// Mark a code consumed. The `used_at IS NULL` guard makes this the single-use +// gate even under a race: rowsAffected === 0 means someone redeemed it first. +export const consumeInviteCode = async ( + client: Client, + code: string, + by: { usedBy: string; usedByEmail: string }, +): Promise => { + const result = await client.execute({ + sql: `UPDATE invite_code SET used_by = ?, used_by_email = ?, used_at = ? + WHERE code = ? AND used_at IS NULL`, + args: [by.usedBy, by.usedByEmail, new Date().toISOString(), code.trim().toUpperCase()], + }); + return result.rowsAffected > 0; +}; diff --git a/apps/host-selfhost/src/auth/seed.ts b/apps/host-selfhost/src/auth/seed.ts index 51ffd6c2e..d93d3ae6e 100644 --- a/apps/host-selfhost/src/auth/seed.ts +++ b/apps/host-selfhost/src/auth/seed.ts @@ -20,29 +20,7 @@ export const seedOrgAndAdmin = async ( client: Client, config: SelfHostConfig, ): Promise<{ organizationId: string; organizationName: string }> => { - const adminEmail = config.bootstrapAdminEmail ?? "admin@localhost"; - - // 1. Bootstrap admin (idempotent: look up by email first). - // oxlint-disable-next-line executor/no-double-cast -- boundary: the SELECT column is the schema contract for the Better Auth `user` row read off the libSQL client - const existingUser = ( - await client.execute({ sql: "SELECT id FROM user WHERE email = ?", args: [adminEmail] }) - ).rows[0] as unknown as { id: string } | undefined; - let adminId = existingUser?.id; - if (!adminId) { - const password = config.bootstrapAdminPassword ?? randomBytes(18).toString("base64url"); - const created = await auth.api.createUser({ - body: { email: adminEmail, password, name: config.bootstrapAdminName, role: "admin" }, - }); - adminId = created.user.id; - if (!config.bootstrapAdminPassword) { - console.warn( - `[executor] created bootstrap admin "${adminEmail}" with a generated password: ${password}\n` + - `[executor] set EXECUTOR_BOOTSTRAP_ADMIN_PASSWORD to choose your own and silence this.`, - ); - } - } - - // 2. The single organization (idempotent: look up by slug first). + // Idempotent: once the single organization exists, boot is past first-run. // oxlint-disable-next-line executor/no-double-cast -- boundary: the SELECT columns are the schema contract for the Better Auth `organization` row read off the libSQL client const existingOrg = ( await client.execute({ @@ -54,14 +32,48 @@ export const seedOrgAndAdmin = async ( return { organizationId: existingOrg.id, organizationName: existingOrg.name }; } - // System action: pass userId so the org is created with no session and the - // admin becomes its owner (creates the membership row). - const org = await auth.api.createOrganization({ - body: { name: config.organizationName, slug: config.orgSlug, userId: adminId }, - }); - if (!org) { - // oxlint-disable-next-line executor/no-try-catch-or-throw, executor/no-error-constructor -- boundary: org creation must succeed for a usable instance - throw new Error("Failed to create the bootstrap organization"); + // Headless bootstrap: when BOTH admin email and password are set, pre-create + // that admin as the org owner (CI / infra-as-code). Otherwise fall through to + // the turnkey path so the first browser visitor claims the instance. + if (config.bootstrapAdminEmail && config.bootstrapAdminPassword) { + // oxlint-disable-next-line executor/no-double-cast -- boundary: the SELECT column is the schema contract for the Better Auth `user` row read off the libSQL client + const existingUser = ( + await client.execute({ + sql: "SELECT id FROM user WHERE email = ?", + args: [config.bootstrapAdminEmail], + }) + ).rows[0] as unknown as { id: string } | undefined; + let adminId = existingUser?.id; + if (!adminId) { + const created = await auth.api.createUser({ + body: { + email: config.bootstrapAdminEmail, + password: config.bootstrapAdminPassword, + name: config.bootstrapAdminName, + role: "admin", + }, + }); + adminId = created.user.id; + } + // Pass userId so the org is created with no session and the admin becomes + // its owner (creates the membership row). + const org = await auth.api.createOrganization({ + body: { name: config.organizationName, slug: config.orgSlug, userId: adminId }, + }); + if (!org) { + // oxlint-disable-next-line executor/no-try-catch-or-throw, executor/no-error-constructor -- boundary: org creation must succeed for a usable instance + throw new Error("Failed to create the bootstrap organization"); + } + return { organizationId: org.id, organizationName: config.organizationName }; } - return { organizationId: org.id, organizationName: config.organizationName }; + + // Turnkey first-run: create the single organization with NO members. The + // first person to open the app signs up ungated and becomes the owner (the + // signup gate enforces this — an org with zero members is unclaimed). + const organizationId = randomBytes(16).toString("hex"); + await client.execute({ + sql: "INSERT INTO organization (id, name, slug, createdAt) VALUES (?, ?, ?, ?)", + args: [organizationId, config.organizationName, config.orgSlug, new Date().toISOString()], + }); + return { organizationId, organizationName: config.organizationName }; }; diff --git a/apps/host-selfhost/src/config.ts b/apps/host-selfhost/src/config.ts index bbd16294a..fea08745c 100644 --- a/apps/host-selfhost/src/config.ts +++ b/apps/host-selfhost/src/config.ts @@ -25,9 +25,10 @@ export interface SelfHostConfig { * internal network unless an operator opts in. */ readonly allowLocalNetwork: boolean; - // Better Auth (slice 3). authSecret is undefined unless configured; the auth - // layer fails loud at boot if it is needed but missing/too short. - readonly authSecret: string | undefined; + // Better Auth session secret. Always resolved (env, else generated + persisted + // under the data dir) so a single-container deploy boots with no env; the auth + // layer still validates an explicitly-set env secret is long enough. + readonly authSecret: string; readonly bootstrapAdminEmail: string | undefined; readonly bootstrapAdminPassword: string | undefined; readonly bootstrapAdminName: string; @@ -69,6 +70,36 @@ export const resolveSecretKey = (): string => { return generated; }; +let cachedAuthSecret: string | undefined; + +/** + * Better Auth session secret. Prefers BETTER_AUTH_SECRET / AUTH_SECRET; + * otherwise generates and persists a strong random secret under the data dir on + * first boot (so a single-container deploy boots with no env and keeps sessions + * valid across restarts). Memoized; mirrors {@link resolveSecretKey}. + */ +export const resolveAuthSecret = (): string => { + if (cachedAuthSecret) return cachedAuthSecret; + const fromEnv = (process.env.BETTER_AUTH_SECRET ?? process.env.AUTH_SECRET)?.trim(); + if (fromEnv) { + cachedAuthSecret = fromEnv; + return fromEnv; + } + const keyPath = join(resolveDataDir(), "auth-secret.key"); + if (existsSync(keyPath)) { + cachedAuthSecret = readFileSync(keyPath, "utf8").trim(); + return cachedAuthSecret; + } + mkdirSync(resolveDataDir(), { recursive: true }); + const generated = randomBytes(32).toString("base64"); + writeFileSync(keyPath, generated, { mode: 0o600 }); + console.warn( + `[executor] generated a session secret at ${keyPath}. Set BETTER_AUTH_SECRET to manage it explicitly (rotating it signs everyone out).`, + ); + cachedAuthSecret = generated; + return generated; +}; + export const loadConfig = (): SelfHostConfig => { const port = Number.parseInt(process.env.PORT ?? "4788", 10); const dataDir = resolveDataDir(); @@ -78,7 +109,7 @@ export const loadConfig = (): SelfHostConfig => { dbPath: process.env.EXECUTOR_DB_PATH ?? join(dataDir, "data.db"), webBaseUrl: process.env.EXECUTOR_WEB_BASE_URL ?? `http://localhost:${port}`, allowLocalNetwork: process.env.EXECUTOR_ALLOW_LOCAL_NETWORK === "true", - authSecret: process.env.BETTER_AUTH_SECRET ?? process.env.AUTH_SECRET, + authSecret: resolveAuthSecret(), bootstrapAdminEmail: process.env.EXECUTOR_BOOTSTRAP_ADMIN_EMAIL, bootstrapAdminPassword: process.env.EXECUTOR_BOOTSTRAP_ADMIN_PASSWORD, bootstrapAdminName: process.env.EXECUTOR_BOOTSTRAP_ADMIN_NAME ?? "Admin", diff --git a/apps/host-selfhost/src/first-run.node.test.ts b/apps/host-selfhost/src/first-run.node.test.ts new file mode 100644 index 000000000..861d993f4 --- /dev/null +++ b/apps/host-selfhost/src/first-run.node.test.ts @@ -0,0 +1,75 @@ +import { existsSync, mkdtempSync } from "node:fs"; +import { tmpdir } from "node:os"; +import { join } from "node:path"; + +import { afterAll, expect, test } from "@effect/vitest"; + +// Fully zero-config boot: NO BETTER_AUTH_SECRET and NO bootstrap admin env, so +// the secret is generated + persisted and the org is created with no members — +// the turnkey first-run path. +const DATA_DIR = mkdtempSync(join(tmpdir(), "eh-firstrun-")); +process.env.EXECUTOR_DATA_DIR = DATA_DIR; +delete process.env.BETTER_AUTH_SECRET; +delete process.env.AUTH_SECRET; +delete process.env.EXECUTOR_BOOTSTRAP_ADMIN_EMAIL; +delete process.env.EXECUTOR_BOOTSTRAP_ADMIN_PASSWORD; + +const { makeSelfHostApiHandler } = await import("./app"); +const { handler, dispose } = await makeSelfHostApiHandler(); +afterAll(() => dispose()); + +const BASE = "http://localhost:4788"; +const get = (path: string) => handler(new Request(`${BASE}${path}`)); +const signUp = (body: Record) => + handler( + new Request(`${BASE}/api/auth/sign-up/email`, { + method: "POST", + headers: { "content-type": "application/json" }, + body: JSON.stringify(body), + }), + ); + +test("zero-config boot generates and persists a session secret in the data dir", () => { + expect(existsSync(join(DATA_DIR, "auth-secret.key"))).toBe(true); +}); + +test("health endpoint reports ok", async () => { + const res = await get("/api/health"); + expect(res.status).toBe(200); + expect(((await res.json()) as { status: string }).status).toBe("ok"); +}); + +test("a fresh instance needs setup, admits the first signup as owner, then gates the rest", async () => { + // Before anyone signs up, the org has zero members. + const before = await get("/api/setup-status"); + expect(before.status).toBe(200); + expect(((await before.json()) as { needsSetup: boolean }).needsSetup).toBe(true); + + // The first signup needs NO invite code and claims the org. + const first = await signUp({ + email: "owner@firstrun.test", + password: "password-12345678", + name: "Owner", + }); + expect(first.status).toBe(200); + const token = first.headers.get("set-auth-token") ?? ""; + expect(token).not.toBe(""); + + // Setup is now complete. + const after = await get("/api/setup-status"); + expect(((await after.json()) as { needsSetup: boolean }).needsSetup).toBe(false); + + // The first user is the owner: the admin API admits them. + const invites = await handler( + new Request(`${BASE}/api/admin/invites`, { headers: { authorization: `Bearer ${token}` } }), + ); + expect(invites.status).toBe(200); + + // A second signup with no code is now rejected — the invite gate is in force. + const second = await signUp({ + email: "intruder@firstrun.test", + password: "password-12345678", + name: "Intruder", + }); + expect(second.status).not.toBe(200); +}); diff --git a/apps/host-selfhost/src/mcp/mcp-oauth.test.ts b/apps/host-selfhost/src/mcp/mcp-oauth.test.ts index f9493a3aa..3ef26cffa 100644 --- a/apps/host-selfhost/src/mcp/mcp-oauth.test.ts +++ b/apps/host-selfhost/src/mcp/mcp-oauth.test.ts @@ -4,6 +4,8 @@ import { join } from "node:path"; import { afterAll, expect, test } from "@effect/vitest"; +import { mintInviteCode } from "../testing/mint-invite"; + process.env.EXECUTOR_DATA_DIR = mkdtempSync(join(tmpdir(), "eh-env-")); process.env.BETTER_AUTH_SECRET = "env-test-secret-0123456789-abcdefghij-klmnop"; process.env.EXECUTOR_BOOTSTRAP_ADMIN_EMAIL = "admin@env.test"; @@ -55,11 +57,12 @@ test("an unauthenticated /mcp request returns 401 with a WWW-Authenticate challe const json = async (res: Response) => (await res.json()) as Record; const signUp = async (email: string): Promise => { + const inviteCode = await mintInviteCode(handler); const res = await handler( new Request(`${BASE}/api/auth/sign-up/email`, { method: "POST", headers: { "content-type": "application/json" }, - body: JSON.stringify({ email, password: "password-12345678", name: email }), + body: JSON.stringify({ email, password: "password-12345678", name: email, inviteCode }), }), ); expect(res.status).toBe(200); diff --git a/apps/host-selfhost/src/mcp/mcp.test.ts b/apps/host-selfhost/src/mcp/mcp.test.ts index 1c51782f1..0f061adec 100644 --- a/apps/host-selfhost/src/mcp/mcp.test.ts +++ b/apps/host-selfhost/src/mcp/mcp.test.ts @@ -4,6 +4,8 @@ import { join } from "node:path"; import { afterAll, expect, test } from "@effect/vitest"; +import { mintInviteCode } from "../testing/mint-invite"; + process.env.EXECUTOR_DATA_DIR = mkdtempSync(join(tmpdir(), "eh-mcp-")); process.env.BETTER_AUTH_SECRET = "mcp-test-secret-0123456789-abcdefghij-klmnop"; process.env.EXECUTOR_BOOTSTRAP_ADMIN_EMAIL = "admin@mcp.test"; @@ -17,11 +19,12 @@ afterAll(() => dispose()); const BASE = "http://localhost:4788"; const signUp = async (email: string): Promise => { + const inviteCode = await mintInviteCode(handler); const res = await handler( new Request(`${BASE}/api/auth/sign-up/email`, { method: "POST", headers: { "content-type": "application/json" }, - body: JSON.stringify({ email, password: "password-12345678", name: email }), + body: JSON.stringify({ email, password: "password-12345678", name: email, inviteCode }), }), ); expect(res.status).toBe(200); diff --git a/apps/host-selfhost/src/mcp/session-store.ts b/apps/host-selfhost/src/mcp/session-store.ts index d798e2630..867bab86f 100644 --- a/apps/host-selfhost/src/mcp/session-store.ts +++ b/apps/host-selfhost/src/mcp/session-store.ts @@ -1,17 +1,14 @@ -import { Data, Effect, Layer } from "effect"; +import { Effect, Layer } from "effect"; import type { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js"; -import { WebStandardStreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/webStandardStreamableHttp.js"; import { ErrorCapture } from "@executor-js/api"; +import { McpErrorReporter, type Principal } from "@executor-js/host-mcp"; import { - jsonRpcErrorBody, - McpErrorReporter, - McpSessionStore, - principalOwns, - type McpDispatchInput, - type McpDispatchResult, - type Principal, -} from "@executor-js/host-mcp"; + inMemoryMcpSessionsLayer, + makeInMemoryMcpSessionStore, + McpEngineBuildError, + type InMemoryMcpSessionStore, +} from "@executor-js/host-mcp/in-memory-session-store"; import { createExecutorMcpServer } from "@executor-js/host-mcp/tool-server"; import { ErrorCaptureLive } from "../observability"; @@ -19,66 +16,27 @@ import { SelfHostDb, type SelfHostDbHandle } from "../db/self-host-db"; import { makeExecutionStack, SelfHostExecutionStackLayer } from "../execution"; // --------------------------------------------------------------------------- -// Self-host McpSessionStore adapter — in-process, no Durable Objects. -// -// In the two-seam envelope the store owns the ENTIRE session lifecycle via -// `dispatch`: create (no session id + POST initialize), forward (session id -// present), and ownership (cross-bearer). Three Maps keyed by mcp-session-id — -// transports, servers, owners — hold the live in-process sessions. Fine for a -// single-node self-host; cloud's DO store is the cross-isolate variant of the -// same seam. The per-user executor is a plain value over the shared DB, so -// closing a session is just closing its transport + server. -// -// The engine is a store implementation detail, not an envelope seam: the store -// builds its per-session `McpServer` via `makeExecutionStack` over the shared -// SelfHostDb (`buildServer` below) + `createExecutorMcpServer`. The two-seam -// envelope has no engine seam — for self-host the store owns engine -// construction; cloud's DO builds its engine inside the DO. +// Self-host McpSessionStore wiring — the shared in-process store +// (`@executor-js/host-mcp/in-memory-session-store`) over self-host's engine. // -// `dispatch` returns the transport `Response` to pass through, or: -// - "not-found" (unknown session id) -> envelope renders 404 -32001 -// - "forbidden" (session owned by another bearer) -> envelope renders 403 -32003 +// The store body (the transports/servers/owners Maps, dispatch, ownership, +// lifetime) is provider-neutral and lives in host-mcp; self-host supplies only +// the per-session `buildServer` (its QuickJS engine over the shared SelfHostDb) +// and the error-reporter override. Cloud's DO store and the Cloudflare host use +// the same `McpSessionStore` seam — different backends behind one envelope. // --------------------------------------------------------------------------- -/** Engine construction failed for a principal. The store surfaces it as a 500. */ -export class McpEngineBuildError extends Data.TaggedError("McpEngineBuildError")<{ - readonly cause: unknown; -}> {} - -const ignoreClose = (close: (() => Promise) | undefined): Promise => - close - ? Effect.runPromise(Effect.ignore(Effect.tryPromise({ try: close, catch: () => undefined }))) - : Promise.resolve(); - -const formatBoundaryError = (error: unknown): unknown => - // oxlint-disable-next-line executor/no-instanceof-error, executor/no-unknown-error-message -- boundary: log unknown MCP SDK/runtime failures - error instanceof Error ? (error.stack ?? error.message) : error; - -// The store's error bodies are INNER responses (no CORS): the serving envelope -// re-wraps the store `Response` with CORS before it leaves the origin, so the -// canonical renderer is called with `cors: false` to stay byte-identical to the -// prior hand-rolled copy (`content-type: application/json` only). -const jsonRpcError = (status: number, code: number, message: string): Response => - jsonRpcErrorBody(status, code, message, { cors: false }); - -/** Build the per-session `McpServer` for a principal (engine + factory config). */ -type BuildServer = (principal: Principal) => Effect.Effect; - -interface SelfHostMcpSessionStore { - readonly store: McpSessionStore["Service"]; - readonly close: () => Promise; -} +export { McpEngineBuildError } from "@executor-js/host-mcp/in-memory-session-store"; /** - * The store's internal engine boundary: build the per-(user,org) scoped - * executor over the long-lived `SelfHostDb` (QuickJS code substrate) and hand - * the engine to `createExecutorMcpServer`. Engine construction reads the - * long-lived DB, so this closes over the handle captured at boot — no - * per-request layer plumbing. NOT an envelope seam; the store owns it. + * The store's internal engine boundary: build the per-(user,org) scoped executor + * over the long-lived `SelfHostDb` (QuickJS code substrate) and hand the engine + * to `createExecutorMcpServer`. Engine construction reads the long-lived DB, so + * this closes over the handle captured at boot — no per-request layer plumbing. */ const makeBuildServer = - (db: SelfHostDbHandle): BuildServer => - (principal) => + (db: SelfHostDbHandle) => + (principal: Principal): Effect.Effect => makeExecutionStack( principal.accountId, principal.organizationId, @@ -92,123 +50,14 @@ const makeBuildServer = ); /** - * Build the in-process session store plus an explicit `close()` that disposes - * all live sessions (wired into the app's shutdown). `close()` is not part of - * the seam — it is the self-host lifetime hook the envelope doesn't own. The - * store builds its per-session engine over the long-lived `SelfHostDb` handle. + * Build the in-process session store (plus its `close()` lifetime hook) over the + * long-lived `SelfHostDb` handle, using self-host's per-session engine builder. */ -export const makeSelfHostMcpSessionStore = (db: SelfHostDbHandle): SelfHostMcpSessionStore => { - const buildServer = makeBuildServer(db); - const transports = new Map(); - const servers = new Map(); - const owners = new Map(); +export const makeSelfHostMcpSessionStore = (db: SelfHostDbHandle): InMemoryMcpSessionStore => + makeInMemoryMcpSessionStore(makeBuildServer(db)); - const dispose = async (id: string, opts: { transport?: boolean; server?: boolean } = {}) => { - const transport = transports.get(id); - const server = servers.get(id); - transports.delete(id); - servers.delete(id); - owners.delete(id); - if (opts.transport) await ignoreClose(transport ? () => transport.close() : undefined); - if (opts.server) await ignoreClose(server ? () => server.close() : undefined); - }; - - /** - * Drive a transport for one web request, recovering any defect to a 500. On a - * fresh transport that never minted a session id (e.g. a non-initialize first - * request), close it and its server eagerly so they don't leak. - */ - const runHandleRequest = ( - transport: WebStandardStreamableHTTPServerTransport, - request: Request, - onClose?: () => void, - ): Effect.Effect => { - const finish = (): void => { - if (onClose && !transport.sessionId) onClose(); - }; - return Effect.promise(() => transport.handleRequest(request)).pipe( - Effect.tap(() => Effect.sync(finish)), - Effect.catchCause((cause) => - Effect.sync(() => { - console.error("[mcp] handleRequest error:", formatBoundaryError(cause)); - finish(); - return jsonRpcError(500, -32603, "Internal server error"); - }), - ), - ); - }; - - /** Forward to an existing session, enforcing ownership against the principal. */ - const forward = ( - sessionId: string, - principal: Principal, - request: Request, - ): Effect.Effect => { - const transport = transports.get(sessionId); - const owner = owners.get(sessionId); - if (!transport || !owner) return Effect.succeed("not-found"); - if (!principalOwns(owner, principal)) return Effect.succeed("forbidden"); - return runHandleRequest(transport, request); - }; - - /** Open a new session: build the server, connect a transport, drive the request. */ - const create = (principal: Principal, request: Request): Effect.Effect => - buildServer(principal).pipe( - Effect.flatMap((server) => - Effect.gen(function* () { - const transport = new WebStandardStreamableHTTPServerTransport({ - sessionIdGenerator: () => crypto.randomUUID(), - enableJsonResponse: true, - onsessioninitialized: (sid) => { - transports.set(sid, transport); - servers.set(sid, server); - owners.set(sid, principal); - }, - onsessionclosed: (sid) => void dispose(sid, { server: true }), - }); - transport.onclose = () => { - const sid = transport.sessionId; - if (sid) void dispose(sid, { server: true }); - }; - yield* Effect.promise(() => server.connect(transport)); - // The session id is minted on the first (initialize) request, so we - // drive `handleRequest` here; if no id results we close eagerly. - return yield* runHandleRequest(transport, request, () => { - void ignoreClose(() => transport.close()); - void ignoreClose(() => server.close()); - }); - }), - ), - // A build failure has nowhere typed to go in the envelope; render a 500. - Effect.catchTag("McpEngineBuildError", () => - Effect.succeed(jsonRpcError(500, -32603, "Internal server error")), - ), - ); - - const store: McpSessionStore["Service"] = { - dispatch: ({ request, principal, sessionId }: McpDispatchInput) => - sessionId ? forward(sessionId, principal, request) : create(principal, request), - dispose: (sessionId) => - Effect.promise(() => dispose(sessionId, { transport: true, server: true })), - }; - - return { - store, - close: async () => { - const ids = new Set([...transports.keys(), ...servers.keys()]); - await Promise.all([...ids].map((id) => dispose(id, { transport: true, server: true }))); - }, - }; -}; - -/** - * Layer wrapping a freshly built in-process store, the `McpSessionStore` - * envelope seam. The owning app calls `makeSelfHostMcpSessionStore(db)` directly - * so it can wire the `close()` lifetime hook into shutdown, then passes the - * built store here. - */ -export const selfHostMcpSessions = (built: SelfHostMcpSessionStore): Layer.Layer => - Layer.succeed(McpSessionStore)(built.store); +/** The `McpSessionStore` envelope seam over a freshly built in-process store. */ +export const selfHostMcpSessions = inMemoryMcpSessionsLayer; // --------------------------------------------------------------------------- // Self-host McpErrorReporter seam — reuses the shared `ErrorCapture` service so diff --git a/apps/host-selfhost/src/multi-user.test.ts b/apps/host-selfhost/src/multi-user.test.ts index c56ca875e..544b913e1 100644 --- a/apps/host-selfhost/src/multi-user.test.ts +++ b/apps/host-selfhost/src/multi-user.test.ts @@ -4,6 +4,8 @@ import { join } from "node:path"; import { afterAll, expect, test } from "@effect/vitest"; +import { mintInviteCode } from "./testing/mint-invite"; + // Real Better Auth path with multiple accounts. process.env.EXECUTOR_DATA_DIR = mkdtempSync(join(tmpdir(), "eh-multi-")); process.env.BETTER_AUTH_SECRET = "multi-user-secret-0123456789-abcdefghij-klmn"; @@ -18,11 +20,12 @@ afterAll(() => dispose()); const BASE = "http://localhost:4788"; const signUp = async (email: string): Promise => { + const inviteCode = await mintInviteCode(handler); const res = await handler( new Request(`${BASE}/api/auth/sign-up/email`, { method: "POST", headers: { "content-type": "application/json" }, - body: JSON.stringify({ email, password: "password-12345678", name: email }), + body: JSON.stringify({ email, password: "password-12345678", name: email, inviteCode }), }), ); expect(res.status).toBe(200); diff --git a/apps/host-selfhost/src/sources-mcp.test.ts b/apps/host-selfhost/src/sources-mcp.test.ts index 50b50d175..6954a8740 100644 --- a/apps/host-selfhost/src/sources-mcp.test.ts +++ b/apps/host-selfhost/src/sources-mcp.test.ts @@ -8,6 +8,7 @@ import { afterAll, expect, test } from "@effect/vitest"; import { makeScopedExecutor } from "@executor-js/api/server"; import { createSelfHostDb, SelfHostDb } from "./db/self-host-db"; +import { mintInviteCode } from "./testing/mint-invite"; import { SelfHostScopedExecutorSeams } from "./execution"; import type { SelfHostPlugins } from "./plugins"; @@ -77,11 +78,17 @@ const addOrgSource = async (organizationId: string): Promise => { }; test("a user's MCP execute sandbox can reach an org source's tools", async () => { + const inviteCode = await mintInviteCode(handler); const su = await handler( new Request(`${BASE}/api/auth/sign-up/email`, { method: "POST", headers: { "content-type": "application/json" }, - body: JSON.stringify({ email: "u@srcmcp.test", password: "password-12345678", name: "U" }), + body: JSON.stringify({ + email: "u@srcmcp.test", + password: "password-12345678", + name: "U", + inviteCode, + }), }), ); const token = su.headers.get("set-auth-token") ?? ""; diff --git a/apps/host-selfhost/src/system/api.ts b/apps/host-selfhost/src/system/api.ts new file mode 100644 index 000000000..ccc9d3568 --- /dev/null +++ b/apps/host-selfhost/src/system/api.ts @@ -0,0 +1,38 @@ +import { HttpApi, HttpApiEndpoint, HttpApiGroup } from "effect/unstable/httpapi"; +import { Schema } from "effect"; + +// --------------------------------------------------------------------------- +// Public system API — unauthenticated status endpoints served under /api. +// +// GET /api/health readiness probe (used by the container healthcheck) +// GET /api/setup-status whether the instance still needs first-run setup, so +// the pre-login SPA can route a fresh operator to /setup +// +// Both are deliberately unauthenticated and return only booleans/status — no +// sensitive data — so they can be read before anyone has signed in. +// --------------------------------------------------------------------------- + +export class SystemError extends Schema.TaggedErrorClass()( + "SystemError", + { message: Schema.String }, + { httpApiStatus: 500 }, +) {} + +export const HealthResponse = Schema.Struct({ status: Schema.String }); +export const SetupStatusResponse = Schema.Struct({ needsSetup: Schema.Boolean }); + +export const SystemApi = HttpApiGroup.make("system") + .add( + HttpApiEndpoint.get("health", "/health", { + success: HealthResponse, + error: [SystemError], + }), + ) + .add( + HttpApiEndpoint.get("setupStatus", "/setup-status", { + success: SetupStatusResponse, + error: [SystemError], + }), + ); + +export const SystemHttpApi = HttpApi.make("executor-self-host-system").add(SystemApi); diff --git a/apps/host-selfhost/src/system/handlers.ts b/apps/host-selfhost/src/system/handlers.ts new file mode 100644 index 000000000..6a0f9a381 --- /dev/null +++ b/apps/host-selfhost/src/system/handlers.ts @@ -0,0 +1,66 @@ +import { HttpApiBuilder } from "effect/unstable/httpapi"; +import { HttpRouter } from "effect/unstable/http"; +import { Effect, Layer } from "effect"; + +import { SystemError, SystemHttpApi } from "./api"; +import { BetterAuth, countOrgMembers, type BetterAuthHandle } from "../auth/better-auth"; +import { SelfHostDb, type SelfHostDbHandle } from "../db/self-host-db"; + +// --------------------------------------------------------------------------- +// Handlers for the public system API. Unauthenticated; every DB touch is an +// Effect.tryPromise. `health` fails soft (a DB hiccup reports "degraded", it +// never throws); `setup-status` reports whether the one org has zero members. +// --------------------------------------------------------------------------- + +export const SystemHandlers = HttpApiBuilder.group(SystemHttpApi, "system", (handlers) => + handlers + .handle("health", () => + Effect.gen(function* () { + const { client } = yield* SelfHostDb; + const status = yield* Effect.tryPromise({ + try: () => client.execute("SELECT 1"), + catch: () => new SystemError({ message: "database unreachable" }), + }).pipe( + Effect.as("ok"), + Effect.orElseSucceed(() => "degraded"), + ); + return { status }; + }), + ) + .handle("setupStatus", () => + Effect.gen(function* () { + const { auth, organizationId } = yield* BetterAuth; + // Count via Better Auth's adapter (see countOrgMembers) so this read is + // consistent with how memberships are written. + const count = yield* Effect.tryPromise({ + try: () => countOrgMembers(auth, organizationId), + catch: () => new SystemError({ message: "failed to read setup status" }), + }); + return { needsSetup: count === 0 }; + }), + ), +); + +export interface SelfHostSystemApiDeps { + readonly betterAuth: BetterAuthHandle; + readonly db: SelfHostDbHandle; + readonly mountPrefix: `/${string}`; +} + +/** Mountable extension route layer (see makeSelfHostAdminApiLayer). */ +export const makeSelfHostSystemApiLayer = ({ + betterAuth, + db, + mountPrefix, +}: SelfHostSystemApiDeps) => { + const prefixedRouter = Layer.effect(HttpRouter.HttpRouter)( + Effect.map(HttpRouter.HttpRouter.asEffect(), (router) => router.prefixed(mountPrefix)), + ); + return HttpApiBuilder.layer(SystemHttpApi).pipe( + Layer.provide(SystemHandlers), + Layer.provide(prefixedRouter), + HttpRouter.provideRequest( + Layer.mergeAll(Layer.succeed(BetterAuth)(betterAuth), Layer.succeed(SelfHostDb)(db)), + ), + ); +}; diff --git a/apps/host-selfhost/src/testing/mint-invite.ts b/apps/host-selfhost/src/testing/mint-invite.ts new file mode 100644 index 000000000..2dc90c73e --- /dev/null +++ b/apps/host-selfhost/src/testing/mint-invite.ts @@ -0,0 +1,56 @@ +import { Effect, Layer } from "effect"; +import { HttpApiClient } from "effect/unstable/httpapi"; +import { FetchHttpClient } from "effect/unstable/http"; + +import { AdminHttpApi } from "../admin/api"; +import { type InviteRole } from "../auth/invites"; + +// Test helper: mint an invite code through the TYPED admin HttpApi client, the +// same surface the web app calls — no raw request building, no direct DB poke. +// The one unavoidable raw call is the bootstrap admin's Better Auth sign-in (an +// auth boundary, not an HttpApi surface); everything after is the typed client. + +type Handler = (request: Request) => Promise; + +const BASE = "http://localhost:4788/api"; + +const signInToken = async (handler: Handler, email: string, password: string): Promise => { + const response = await handler( + new Request("http://localhost:4788/api/auth/sign-in/email", { + method: "POST", + headers: { "content-type": "application/json" }, + body: JSON.stringify({ email, password }), + }), + ); + return response.headers.get("set-auth-token") ?? ""; +}; + +// A FetchHttpClient backed by the in-process handler, carrying the admin bearer. +const clientLayer = (handler: Handler, token: string) => + FetchHttpClient.layer.pipe( + Layer.provide( + Layer.succeed(FetchHttpClient.Fetch)(((input: RequestInfo | URL, init?: RequestInit) => { + const base = input instanceof Request ? input : new Request(input, init); + const request = new Request(base, { + headers: { ...Object.fromEntries(base.headers), authorization: `Bearer ${token}` }, + }); + return handler(request); + }) as typeof globalThis.fetch), + ), + ); + +export const mintInviteCode = async ( + handler: Handler, + role: InviteRole = "member", +): Promise => { + const token = await signInToken( + handler, + process.env.EXECUTOR_BOOTSTRAP_ADMIN_EMAIL!, + process.env.EXECUTOR_BOOTSTRAP_ADMIN_PASSWORD!, + ); + return Effect.gen(function* () { + const client = yield* HttpApiClient.make(AdminHttpApi, { baseUrl: BASE }); + const invite = yield* client.admin.createInvite({ payload: { role } }); + return invite.code; + }).pipe(Effect.provide(clientLayer(handler, token)), Effect.runPromise); +}; diff --git a/apps/host-selfhost/web/admin-atoms.tsx b/apps/host-selfhost/web/admin-atoms.tsx new file mode 100644 index 000000000..f97a7453c --- /dev/null +++ b/apps/host-selfhost/web/admin-atoms.tsx @@ -0,0 +1,22 @@ +import { AdminApiClient } from "./admin-client"; + +// --------------------------------------------------------------------------- +// Self-host admin atoms — typed, cached, reactive queries/mutations over the +// app-local /api/admin/* invite-code surface, on the same atom registry as the +// shared account atoms. Member management reuses the shared account atoms; only +// invite codes are new here. +// --------------------------------------------------------------------------- + +// Local reactivity key: invites only matter within this client, so they don't +// belong in the shared cross-client ReactivityKey set. +const INVITES_KEY = "self-host:invites"; + +export const invitesAtom = AdminApiClient.query("admin", "listInvites", { + reactivityKeys: [INVITES_KEY], +}); + +export const createInvite = AdminApiClient.mutation("admin", "createInvite"); +export const revokeInvite = AdminApiClient.mutation("admin", "revokeInvite"); + +/** Mutations that change the invite list pass these at the call site. */ +export const inviteWriteKeys = [INVITES_KEY] as const; diff --git a/apps/host-selfhost/web/admin-client.tsx b/apps/host-selfhost/web/admin-client.tsx new file mode 100644 index 000000000..82141d8e1 --- /dev/null +++ b/apps/host-selfhost/web/admin-client.tsx @@ -0,0 +1,35 @@ +import * as AtomHttpApi from "effect/unstable/reactivity/AtomHttpApi"; +import { FetchHttpClient, HttpClient, HttpClientRequest } from "effect/unstable/http"; +import * as Effect from "effect/Effect"; + +import { reportApiClientInfrastructureCause } from "@executor-js/react/api/client"; +import { + getExecutorApiBaseUrl, + getExecutorServerAuthorizationHeader, +} from "@executor-js/react/api/server-connection"; + +import { AdminHttpApi } from "../src/admin/api"; + +// --------------------------------------------------------------------------- +// Self-host admin atom client — the invite-code surface (/api/admin/*). +// +// Same construction as the shared AccountApiClient (base-url prepend + +// same-origin session cookie / optional bearer), but for the app-local admin +// HttpApi. Self-host only: cloud has no invite codes. +// --------------------------------------------------------------------------- + +const AdminApiClient = AtomHttpApi.Service<"SelfHostAdminApiClient">()("SelfHostAdminApiClient", { + api: AdminHttpApi, + httpClient: FetchHttpClient.layer, + transformClient: HttpClient.mapRequest((request) => { + let next = HttpClientRequest.prependUrl(request, getExecutorApiBaseUrl()); + const authorization = getExecutorServerAuthorizationHeader(); + if (authorization) { + next = HttpClientRequest.setHeader(next, "authorization", authorization); + } + return next; + }), + transformResponse: (effect) => Effect.tapCause(effect, reportApiClientInfrastructureCause), +}); + +export { AdminApiClient }; diff --git a/apps/host-selfhost/web/login.tsx b/apps/host-selfhost/web/login.tsx index ac88a22ed..ca8a9e1eb 100644 --- a/apps/host-selfhost/web/login.tsx +++ b/apps/host-selfhost/web/login.tsx @@ -6,104 +6,117 @@ import { Label } from "@executor-js/react/components/label"; import { authClient } from "./auth-client"; -// Self-host login: email + password sign-in / sign-up via Better Auth. On -// success we reload so the shared AuthProvider re-reads /account/me and the -// AuthGate swaps in the app. (Cloud's equivalent is a WorkOS redirect — this -// is the provider-specific piece injected into the shared shell.) +// Self-host login: email + password sign-in via Better Auth. On success we +// reload so the shared AuthProvider re-reads /account/me and the AuthGate swaps +// in the app. (Cloud's equivalent is a WorkOS redirect — this is the +// provider-specific piece injected into the shared shell.) +// +// There is no self-signup here: open registration is closed. New people join by +// redeeming an invite — either the full /join/ link, or by entering the +// code here ("Have an invite code?"), which forwards to the same join page. export const LoginPage = () => { - const [mode, setMode] = useState<"signin" | "signup">("signin"); - const [name, setName] = useState(""); + const [mode, setMode] = useState<"signin" | "code">("signin"); const [email, setEmail] = useState(""); const [password, setPassword] = useState(""); + const [code, setCode] = useState(""); const [error, setError] = useState(null); const [busy, setBusy] = useState(false); - const submit = async (event: FormEvent) => { + const signIn = async (event: FormEvent) => { event.preventDefault(); setBusy(true); setError(null); - const result = - mode === "signin" - ? await authClient.signIn.email({ email, password }) - : await authClient.signUp.email({ email, password, name }); + const result = await authClient.signIn.email({ email, password }); if (result.error) { setBusy(false); - setError(result.error.message ?? (mode === "signin" ? "Sign in failed" : "Sign up failed")); + setError(result.error.message ?? "Sign in failed"); return; } window.location.href = "/"; }; + const redeem = (event: FormEvent) => { + event.preventDefault(); + const trimmed = code.trim(); + if (!trimmed) return; + // Forward to the join page, which collects name/email/password and redeems. + window.location.href = `/join/${encodeURIComponent(trimmed)}`; + }; + return (
-
+

Executor

- {mode === "signin" ? "Sign in to your instance" : "Create your account"} + {mode === "signin" ? "Sign in to your instance" : "Join with your invite code"}

- {mode === "signup" && ( -
- - setName((e.target as HTMLInputElement).value)} - autoComplete="name" - required - /> -
+ {mode === "signin" ? ( + +
+ + setEmail((e.target as HTMLInputElement).value)} + autoComplete="email" + required + /> +
+
+ + setPassword((e.target as HTMLInputElement).value)} + autoComplete="current-password" + required + minLength={8} + /> +
+ {error &&

{error}

} + + + ) : ( +
+
+ + setCode((e.target as HTMLInputElement).value)} + autoFocus + /> +
+ +
)} -
- - setEmail((e.target as HTMLInputElement).value)} - autoComplete="email" - required - /> -
-
- - setPassword((e.target as HTMLInputElement).value)} - autoComplete={mode === "signin" ? "current-password" : "new-password"} - required - minLength={8} - /> -
- - {error &&

{error}

} - - - - +
+ +
+
); }; diff --git a/apps/host-selfhost/web/routeTree.gen.ts b/apps/host-selfhost/web/routeTree.gen.ts index 675d169fc..417e8afd4 100644 --- a/apps/host-selfhost/web/routeTree.gen.ts +++ b/apps/host-selfhost/web/routeTree.gen.ts @@ -14,9 +14,11 @@ import { Route as SecretsRouteImport } from './routes/secrets' import { Route as PoliciesRouteImport } from './routes/policies' import { Route as ConnectionsRouteImport } from './routes/connections' import { Route as ApiKeysRouteImport } from './routes/api-keys' +import { Route as AdminRouteImport } from './routes/admin' import { Route as IndexRouteImport } from './routes/index' import { Route as SourcesNamespaceRouteImport } from './routes/sources.$namespace' import { Route as ResumeExecutionIdRouteImport } from './routes/resume.$executionId' +import { Route as JoinCodeRouteImport } from './routes/join.$code' import { Route as SourcesAddPluginKeyRouteImport } from './routes/sources.add.$pluginKey' import { Route as PluginsPluginIdSplatRouteImport } from './routes/plugins.$pluginId.$' @@ -45,6 +47,11 @@ const ApiKeysRoute = ApiKeysRouteImport.update({ path: '/api-keys', getParentRoute: () => rootRouteImport, } as any) +const AdminRoute = AdminRouteImport.update({ + id: '/admin', + path: '/admin', + getParentRoute: () => rootRouteImport, +} as any) const IndexRoute = IndexRouteImport.update({ id: '/', path: '/', @@ -60,6 +67,11 @@ const ResumeExecutionIdRoute = ResumeExecutionIdRouteImport.update({ path: '/resume/$executionId', getParentRoute: () => rootRouteImport, } as any) +const JoinCodeRoute = JoinCodeRouteImport.update({ + id: '/join/$code', + path: '/join/$code', + getParentRoute: () => rootRouteImport, +} as any) const SourcesAddPluginKeyRoute = SourcesAddPluginKeyRouteImport.update({ id: '/sources/add/$pluginKey', path: '/sources/add/$pluginKey', @@ -73,11 +85,13 @@ const PluginsPluginIdSplatRoute = PluginsPluginIdSplatRouteImport.update({ export interface FileRoutesByFullPath { '/': typeof IndexRoute + '/admin': typeof AdminRoute '/api-keys': typeof ApiKeysRoute '/connections': typeof ConnectionsRoute '/policies': typeof PoliciesRoute '/secrets': typeof SecretsRoute '/tools': typeof ToolsRoute + '/join/$code': typeof JoinCodeRoute '/resume/$executionId': typeof ResumeExecutionIdRoute '/sources/$namespace': typeof SourcesNamespaceRoute '/plugins/$pluginId/$': typeof PluginsPluginIdSplatRoute @@ -85,11 +99,13 @@ export interface FileRoutesByFullPath { } export interface FileRoutesByTo { '/': typeof IndexRoute + '/admin': typeof AdminRoute '/api-keys': typeof ApiKeysRoute '/connections': typeof ConnectionsRoute '/policies': typeof PoliciesRoute '/secrets': typeof SecretsRoute '/tools': typeof ToolsRoute + '/join/$code': typeof JoinCodeRoute '/resume/$executionId': typeof ResumeExecutionIdRoute '/sources/$namespace': typeof SourcesNamespaceRoute '/plugins/$pluginId/$': typeof PluginsPluginIdSplatRoute @@ -98,11 +114,13 @@ export interface FileRoutesByTo { export interface FileRoutesById { __root__: typeof rootRouteImport '/': typeof IndexRoute + '/admin': typeof AdminRoute '/api-keys': typeof ApiKeysRoute '/connections': typeof ConnectionsRoute '/policies': typeof PoliciesRoute '/secrets': typeof SecretsRoute '/tools': typeof ToolsRoute + '/join/$code': typeof JoinCodeRoute '/resume/$executionId': typeof ResumeExecutionIdRoute '/sources/$namespace': typeof SourcesNamespaceRoute '/plugins/$pluginId/$': typeof PluginsPluginIdSplatRoute @@ -112,11 +130,13 @@ export interface FileRouteTypes { fileRoutesByFullPath: FileRoutesByFullPath fullPaths: | '/' + | '/admin' | '/api-keys' | '/connections' | '/policies' | '/secrets' | '/tools' + | '/join/$code' | '/resume/$executionId' | '/sources/$namespace' | '/plugins/$pluginId/$' @@ -124,11 +144,13 @@ export interface FileRouteTypes { fileRoutesByTo: FileRoutesByTo to: | '/' + | '/admin' | '/api-keys' | '/connections' | '/policies' | '/secrets' | '/tools' + | '/join/$code' | '/resume/$executionId' | '/sources/$namespace' | '/plugins/$pluginId/$' @@ -136,11 +158,13 @@ export interface FileRouteTypes { id: | '__root__' | '/' + | '/admin' | '/api-keys' | '/connections' | '/policies' | '/secrets' | '/tools' + | '/join/$code' | '/resume/$executionId' | '/sources/$namespace' | '/plugins/$pluginId/$' @@ -149,11 +173,13 @@ export interface FileRouteTypes { } export interface RootRouteChildren { IndexRoute: typeof IndexRoute + AdminRoute: typeof AdminRoute ApiKeysRoute: typeof ApiKeysRoute ConnectionsRoute: typeof ConnectionsRoute PoliciesRoute: typeof PoliciesRoute SecretsRoute: typeof SecretsRoute ToolsRoute: typeof ToolsRoute + JoinCodeRoute: typeof JoinCodeRoute ResumeExecutionIdRoute: typeof ResumeExecutionIdRoute SourcesNamespaceRoute: typeof SourcesNamespaceRoute PluginsPluginIdSplatRoute: typeof PluginsPluginIdSplatRoute @@ -197,6 +223,13 @@ declare module '@tanstack/react-router' { preLoaderRoute: typeof ApiKeysRouteImport parentRoute: typeof rootRouteImport } + '/admin': { + id: '/admin' + path: '/admin' + fullPath: '/admin' + preLoaderRoute: typeof AdminRouteImport + parentRoute: typeof rootRouteImport + } '/': { id: '/' path: '/' @@ -218,6 +251,13 @@ declare module '@tanstack/react-router' { preLoaderRoute: typeof ResumeExecutionIdRouteImport parentRoute: typeof rootRouteImport } + '/join/$code': { + id: '/join/$code' + path: '/join/$code' + fullPath: '/join/$code' + preLoaderRoute: typeof JoinCodeRouteImport + parentRoute: typeof rootRouteImport + } '/sources/add/$pluginKey': { id: '/sources/add/$pluginKey' path: '/sources/add/$pluginKey' @@ -237,11 +277,13 @@ declare module '@tanstack/react-router' { const rootRouteChildren: RootRouteChildren = { IndexRoute: IndexRoute, + AdminRoute: AdminRoute, ApiKeysRoute: ApiKeysRoute, ConnectionsRoute: ConnectionsRoute, PoliciesRoute: PoliciesRoute, SecretsRoute: SecretsRoute, ToolsRoute: ToolsRoute, + JoinCodeRoute: JoinCodeRoute, ResumeExecutionIdRoute: ResumeExecutionIdRoute, SourcesNamespaceRoute: SourcesNamespaceRoute, PluginsPluginIdSplatRoute: PluginsPluginIdSplatRoute, diff --git a/apps/host-selfhost/web/routes/__root.tsx b/apps/host-selfhost/web/routes/__root.tsx index 969e6a62c..aff13915c 100644 --- a/apps/host-selfhost/web/routes/__root.tsx +++ b/apps/host-selfhost/web/routes/__root.tsx @@ -1,5 +1,5 @@ -import { createRootRoute } from "@tanstack/react-router"; -import type { ReactNode } from "react"; +import { createRootRoute, Outlet, useRouterState } from "@tanstack/react-router"; +import { useEffect, useState, type ReactNode } from "react"; import { ExecutorProvider } from "@executor-js/react/api/provider"; import { ExecutorPluginsProvider } from "@executor-js/sdk/client"; @@ -10,6 +10,8 @@ import { plugins as clientPlugins } from "virtual:executor/plugins-client"; import { authClient } from "../auth-client"; import { LoginPage } from "../login"; +import { SetupPage } from "../setup"; +import { fetchNeedsSetup } from "../setup-status"; // --------------------------------------------------------------------------- // Self-host root: the SHARED multiplayer composition with Better Auth as the @@ -22,33 +24,66 @@ export const Route = createRootRoute({ component: RootComponent, }); +// Self-host adds the instance Admin page (members + invite links) to the shared +// nav. The page and its API gate to owner/admin, so a non-admin who opens it +// just sees the access notice. +const selfHostNavItems = [...defaultShellNavItems, { to: "/admin", label: "Admin" }]; + const signOut = async () => { await authClient.signOut(); window.location.href = "/"; }; +const Loading = () => ( +
+ Loading… +
+); + function AuthGate({ children }: { children: ReactNode }) { const auth = useAuth(); - if (auth.status === "loading") { - return ( -
- Loading… -
- ); - } + // When unauthenticated, decide between first-run setup and sign-in by asking + // the server whether the instance still has zero members. `null` = checking. + const [needsSetup, setNeedsSetup] = useState(null); + useEffect(() => { + if (auth.status !== "unauthenticated") return; + let alive = true; + void fetchNeedsSetup().then((value) => { + if (alive) setNeedsSetup(value); + }); + return () => { + alive = false; + }; + }, [auth.status]); + + if (auth.status === "loading") return ; if (auth.status === "unauthenticated") { - return ; + if (needsSetup === null) return ; + return needsSetup ? : ; } return <>{children}; } function RootComponent() { + const pathname = useRouterState({ select: (s) => s.location.pathname }); + + // The join page is public + chromeless: a new user redeeming an invite link + // has no session yet, so it renders outside the auth gate and the shell. + if (pathname.startsWith("/join/")) { + return ( + <> + + + + ); + } + return ( - + diff --git a/apps/host-selfhost/web/routes/admin.tsx b/apps/host-selfhost/web/routes/admin.tsx new file mode 100644 index 000000000..89753082f --- /dev/null +++ b/apps/host-selfhost/web/routes/admin.tsx @@ -0,0 +1,251 @@ +import { createFileRoute } from "@tanstack/react-router"; +import { useState } from "react"; +import { Exit } from "effect"; +import * as AsyncResult from "effect/unstable/reactivity/AsyncResult"; +import { useAtom, useAtomValue } from "@effect/atom-react"; +import { toast } from "@executor-js/react/components/sonner"; + +import { Button } from "@executor-js/react/components/button"; +import { CopyButton } from "@executor-js/react/components/copy-button"; +import { Input } from "@executor-js/react/components/input"; +import { Label } from "@executor-js/react/components/label"; +import { NativeSelect, NativeSelectOption } from "@executor-js/react/components/native-select"; +import { + orgMembersAtom, + removeMember, + updateMemberRole, +} from "@executor-js/react/api/account-atoms"; +import { orgMemberWriteKeys } from "@executor-js/react/api/reactivity-keys"; + +import { createInvite, invitesAtom, inviteWriteKeys, revokeInvite } from "../admin-atoms"; + +export const Route = createFileRoute("/admin")({ + component: AdminPage, +}); + +const ROLES = ["member", "admin"] as const; + +// Instance admin console. Members reuse the shared account atoms; invite codes +// are the self-host join mechanism. The API gates to owner/admin, so a +// non-admin who opens this just sees load failures. +function AdminPage() { + return ( +
+
+
+

Admin

+

+ Manage members and invite links for this instance. +

+
+ + +
+
+ ); +} + +function MembersSection() { + const result = useAtomValue(orgMembersAtom); + const [roleState, doUpdateRole] = useAtom(updateMemberRole, { mode: "promiseExit" }); + const [removeState, doRemove] = useAtom(removeMember, { mode: "promiseExit" }); + // The mutation atoms carry their own in-flight state — no manual busy tracking. + const busy = AsyncResult.isWaiting(roleState) || AsyncResult.isWaiting(removeState); + + const changeRole = async (membershipId: string, roleSlug: string) => { + const exit = await doUpdateRole({ + params: { membershipId }, + payload: { roleSlug }, + reactivityKeys: orgMemberWriteKeys, + }); + toast[Exit.isSuccess(exit) ? "success" : "error"]( + Exit.isSuccess(exit) ? "Role updated" : "Failed to update role", + ); + }; + + const remove = async (membershipId: string, label: string) => { + const exit = await doRemove({ params: { membershipId }, reactivityKeys: orgMemberWriteKeys }); + toast[Exit.isSuccess(exit) ? "success" : "error"]( + Exit.isSuccess(exit) ? `Removed ${label}` : "Failed to remove member", + ); + }; + + return ( +
+

Members

+ {AsyncResult.match(result, { + onInitial: () => Loading members…, + onFailure: () => Admin access required., + onSuccess: ({ value }) => ( +
+ {value.members.map((member) => { + const isOwner = member.role === "owner"; + return ( +
+
+

+ {member.name ?? member.email} + {member.isCurrentUser ? " (you)" : ""} +

+

{member.email}

+
+ {isOwner || member.isCurrentUser ? ( + + {member.role} + + ) : ( + <> + changeRole(member.id, e.target.value)} + > + {ROLES.map((role) => ( + + {role} + + ))} + + + + )} +
+ ); + })} +
+ ), + })} +
+ ); +} + +function InvitesSection() { + const result = useAtomValue(invitesAtom); + const [createState, doCreate] = useAtom(createInvite, { mode: "promiseExit" }); + const [, doRevoke] = useAtom(revokeInvite, { mode: "promiseExit" }); + const [role, setRole] = useState("member"); + const [label, setLabel] = useState(""); + const creating = AsyncResult.isWaiting(createState); + + const create = async () => { + const exit = await doCreate({ + payload: { role, label: label.trim() || undefined }, + reactivityKeys: inviteWriteKeys, + }); + if (Exit.isSuccess(exit)) { + setLabel(""); + setRole("member"); + toast.success("Invite link created"); + return; + } + toast.error("Failed to create invite"); + }; + + const revoke = async (inviteId: string) => { + const exit = await doRevoke({ params: { inviteId }, reactivityKeys: inviteWriteKeys }); + toast[Exit.isSuccess(exit) ? "success" : "error"]( + Exit.isSuccess(exit) ? "Invite revoked" : "Failed to revoke invite", + ); + }; + + return ( +
+

Invite links

+
+
+ + setLabel(e.target.value)} + /> +
+
+ + setRole(e.target.value)}> + {ROLES.map((r) => ( + + {r} + + ))} + +
+ +
+ + {AsyncResult.match(result, { + onInitial: () => Loading invites…, + onFailure: () => Admin access required., + onSuccess: ({ value }) => { + const pending = value.invites.filter((i) => !i.usedAt); + const used = value.invites.filter((i) => i.usedAt); + return ( +
+ {pending.length > 0 && ( +
+ {pending.map((invite) => ( +
+ {invite.code} + + {invite.label ? `${invite.label} · ` : ""} + {invite.role} + + + +
+ ))} +
+ )} + {used.length > 0 && ( +
+

Redeemed

+
+ {used.map((invite) => ( +
+ + {invite.code} + + + {invite.label ? `${invite.label} · ` : ""} + used by {invite.usedByEmail} + +
+ ))} +
+
+ )} + {pending.length === 0 && used.length === 0 && ( + No invite links yet — create one to add someone. + )} +
+ ); + }, + })} +
+ ); +} + +function Notice({ children, tone }: { children: React.ReactNode; tone?: "destructive" }) { + return ( +
+ {children} +
+ ); +} diff --git a/apps/host-selfhost/web/routes/join.$code.tsx b/apps/host-selfhost/web/routes/join.$code.tsx new file mode 100644 index 000000000..f8394bb53 --- /dev/null +++ b/apps/host-selfhost/web/routes/join.$code.tsx @@ -0,0 +1,104 @@ +import { createFileRoute } from "@tanstack/react-router"; +import { useState, type FormEvent } from "react"; + +import { Button } from "@executor-js/react/components/button"; +import { Input } from "@executor-js/react/components/input"; +import { Label } from "@executor-js/react/components/label"; + +import { authClient } from "../auth-client"; + +export const Route = createFileRoute("/join/$code")({ + component: JoinPage, +}); + +// Public, chromeless account-creation page. Reached at /join/: the code +// is the credential that lets a new person self-register. It rides on the +// signup request body; the server's create gate validates + burns it and drops +// the new user into the org as a member. The root renders this outside the +// auth gate (an un-redeemed visitor has no session yet). +function JoinPage() { + const { code } = Route.useParams(); + const [name, setName] = useState(""); + const [email, setEmail] = useState(""); + const [password, setPassword] = useState(""); + const [error, setError] = useState(null); + const [busy, setBusy] = useState(false); + + const submit = async (event: FormEvent) => { + event.preventDefault(); + setBusy(true); + setError(null); + // The Better Auth client forwards `inviteCode` (a non-schema field) onto the + // signup body the create gate reads; same-origin, so the session cookie + // sticks. Returns `{ error }` rather than throwing — no manual fetch. + const result = await authClient.signUp.email({ name, email, password, inviteCode: code }); + if (result.error) { + setBusy(false); + setError( + result.error.message ?? + "Could not create your account. Check your invite link and try again.", + ); + return; + } + window.location.href = "/"; + }; + + return ( +
+
+
+

Join Executor

+

+ You've been invited — create your account. +

+
+ +
+ + setName((e.target as HTMLInputElement).value)} + autoComplete="name" + required + /> +
+
+ + setEmail((e.target as HTMLInputElement).value)} + autoComplete="email" + required + /> +
+
+ + setPassword((e.target as HTMLInputElement).value)} + autoComplete="new-password" + required + minLength={8} + /> +
+ + {error &&

{error}

} + + +
+
+ ); +} diff --git a/apps/host-selfhost/web/setup-status.ts b/apps/host-selfhost/web/setup-status.ts new file mode 100644 index 000000000..a91c154a6 --- /dev/null +++ b/apps/host-selfhost/web/setup-status.ts @@ -0,0 +1,17 @@ +// Pre-login check of whether the instance still needs first-run setup (its one +// org has zero members). Read by the auth gate to choose the setup vs sign-in +// screen. A plain same-origin fetch — the same boundary the /join + setup +// screens use, which run before the atom registry exists. Two-arg `then` keeps +// it Promise.catch-free; any failure falls back to "no setup needed" (sign-in). +export const fetchNeedsSetup = async (): Promise => { + const response = await fetch("/api/setup-status", { credentials: "same-origin" }).then( + (r) => r, + () => null, + ); + if (!response || !response.ok) return false; + const data = (await response.json().then( + (d) => d, + () => ({}), + )) as { needsSetup?: boolean }; + return data.needsSetup === true; +}; diff --git a/apps/host-selfhost/web/setup.tsx b/apps/host-selfhost/web/setup.tsx new file mode 100644 index 000000000..d038538b2 --- /dev/null +++ b/apps/host-selfhost/web/setup.tsx @@ -0,0 +1,92 @@ +import { useState, type FormEvent } from "react"; + +import { Button } from "@executor-js/react/components/button"; +import { Input } from "@executor-js/react/components/input"; +import { Label } from "@executor-js/react/components/label"; + +import { authClient } from "./auth-client"; + +// First-run setup. A fresh instance has no users, so the first visitor creates +// the admin account here. The server admits the first signup into the empty org +// as its owner (no invite code needed); once anyone is a member, signup is +// invite-gated and this page is never shown again. The auth gate renders this +// when /api/setup-status reports the instance still needs setup. +export const SetupPage = () => { + const [name, setName] = useState(""); + const [email, setEmail] = useState(""); + const [password, setPassword] = useState(""); + const [error, setError] = useState(null); + const [busy, setBusy] = useState(false); + + const submit = async (event: FormEvent) => { + event.preventDefault(); + setBusy(true); + setError(null); + const result = await authClient.signUp.email({ name, email, password }); + if (result.error) { + setBusy(false); + setError(result.error.message ?? "Could not create the admin account."); + return; + } + window.location.href = "/"; + }; + + return ( +
+
+
+

Set up Executor

+

+ Create the admin account for this instance. +

+
+ +
+ + setName((e.target as HTMLInputElement).value)} + autoComplete="name" + required + /> +
+
+ + setEmail((e.target as HTMLInputElement).value)} + autoComplete="email" + required + /> +
+
+ + setPassword((e.target as HTMLInputElement).value)} + autoComplete="new-password" + required + minLength={8} + /> +
+ + {error &&

{error}

} + + +
+
+ ); +}; diff --git a/apps/local/src/executor.ts b/apps/local/src/executor.ts index 3e98833a6..265a905a7 100644 --- a/apps/local/src/executor.ts +++ b/apps/local/src/executor.ts @@ -50,7 +50,7 @@ const localNamespace = "executor_local"; // temp folder because drizzle's migrator accepts a folder path. const resolveMigrationsFolder = (): string => { if (!embeddedMigrations) { - return join(import.meta.dirname, "../../drizzle"); + return join(import.meta.dirname, "../drizzle"); } const dir = fs.mkdtempSync(join(tmpdir(), "executor-migrations-")); diff --git a/bun.lock b/bun.lock index 2672ced5e..1ccaea9ce 100644 --- a/bun.lock +++ b/bun.lock @@ -151,6 +151,46 @@ "vite": "catalog:", }, }, + "apps/host-cloudflare": { + "name": "@executor-js/host-cloudflare", + "dependencies": { + "@effect/atom-react": "catalog:", + "@executor-js/api": "workspace:*", + "@executor-js/app": "workspace:*", + "@executor-js/execution": "workspace:*", + "@executor-js/host-mcp": "workspace:*", + "@executor-js/plugin-encrypted-secrets": "workspace:*", + "@executor-js/plugin-graphql": "workspace:*", + "@executor-js/plugin-mcp": "workspace:*", + "@executor-js/plugin-openapi": "workspace:*", + "@executor-js/react": "workspace:*", + "@executor-js/runtime-quickjs": "workspace:*", + "@executor-js/sdk": "workspace:*", + "@jitl/quickjs-wasmfile-release-sync": "catalog:", + "@modelcontextprotocol/sdk": "^1.29.0", + "@tanstack/react-router": "catalog:", + "drizzle-orm": "catalog:", + "effect": "catalog:", + "fumadb": "workspace:*", + "jose": "^5.9.6", + "quickjs-emscripten-core": "0.31.0", + "react": "catalog:", + "react-dom": "catalog:", + }, + "devDependencies": { + "@cloudflare/workers-types": "^4.20250410.0", + "@executor-js/vite-plugin": "workspace:*", + "@tailwindcss/vite": "catalog:", + "@tanstack/router-plugin": "^1.167.12", + "@types/node": "catalog:", + "@types/react": "catalog:", + "@types/react-dom": "catalog:", + "@vitejs/plugin-react": "catalog:", + "typescript": "catalog:", + "vite": "catalog:", + "wrangler": "^4.95.0", + }, + }, "apps/host-selfhost": { "name": "@executor-js/host-selfhost", "version": "0.0.0", @@ -1190,7 +1230,7 @@ "@clack/prompts": ["@clack/prompts@1.3.0", "", { "dependencies": { "@clack/core": "1.3.0", "fast-string-width": "^3.0.2", "fast-wrap-ansi": "^0.2.0", "sisteransi": "^1.0.5" } }, "sha512-GgcWwRCs/xPtaqlMy8qRhPnZf9vlWcWZNHAitnVQ3yk7JmSralSiq5q07yaffYE8SogtDm7zFeKccx1QNVARpw=="], - "@cloudflare/kv-asset-handler": ["@cloudflare/kv-asset-handler@0.4.2", "", {}, "sha512-SIOD2DxrRRwQ+jgzlXCqoEFiKOFqaPjhnNTGKXSRLvp1HiOvapLaFG2kEr9dYQTYe8rKrd9uvDUzmAITeNyaHQ=="], + "@cloudflare/kv-asset-handler": ["@cloudflare/kv-asset-handler@0.5.0", "", {}, "sha512-jxQYkj8dSIzc0cD6cMMNdOc1UVjqSqu8BZdor5s8cGjW2I8BjODt/kWPVdY+u9zj3ms75Q5qaZgnxUad83+eAg=="], "@cloudflare/unenv-preset": ["@cloudflare/unenv-preset@2.16.1", "", { "peerDependencies": { "unenv": "2.0.0-rc.24", "workerd": ">1.20260305.0 <2.0.0-0" }, "optionalPeers": ["workerd"] }, "sha512-ECxObrMfyTl5bhQf/lZCXwo5G6xX9IAUo+nDMKK4SZ8m4Jvvxp52vilxyySSWh2YTZz8+HQ07qGH/2rEom1vDw=="], @@ -1198,15 +1238,15 @@ "@cloudflare/vitest-pool-workers": ["@cloudflare/vitest-pool-workers@0.15.0", "", { "dependencies": { "cjs-module-lexer": "^1.2.3", "esbuild": "0.27.3", "miniflare": "4.20260424.0", "wrangler": "4.85.0", "zod": "^3.25.76" }, "peerDependencies": { "@vitest/runner": "^4.1.0", "@vitest/snapshot": "^4.1.0", "vitest": "^4.1.0" } }, "sha512-RldzOt2az3mxICTxT7GTSBpm6f61lx4LWSilRHm4pJlYAGmfGu1pyinqJw3UmPZS9N/mrN7XwdZAqFV6hhmWaQ=="], - "@cloudflare/workerd-darwin-64": ["@cloudflare/workerd-darwin-64@1.20260424.1", "", { "os": "darwin", "cpu": "x64" }, "sha512-yFR1XaJbSDLg/qbwtrYaU2xwFXatIPKR5nrMQCN1q/m6+Qe/j6r+kCnFEvOJjMZOm9iCKsE6Qly5clgl4u32qw=="], + "@cloudflare/workerd-darwin-64": ["@cloudflare/workerd-darwin-64@1.20260526.1", "", { "os": "darwin", "cpu": "x64" }, "sha512-/pR3GH3gfv0PUp7DjI8v0aAIDOqFwibq4bg5xT7TZgcVdBV/cJQWckdXCMqiRtHiawLwogUX00EIOINkYJ1Zqg=="], - "@cloudflare/workerd-darwin-arm64": ["@cloudflare/workerd-darwin-arm64@1.20260424.1", "", { "os": "darwin", "cpu": "arm64" }, "sha512-LqWKcE7x/9KyC2iQvKPeb20hKST3dYXDZlYTvFymgR1DfLS0OFOCzVGTloVNd7WqvK4SkdzBYfxo7QMIAeBK0w=="], + "@cloudflare/workerd-darwin-arm64": ["@cloudflare/workerd-darwin-arm64@1.20260526.1", "", { "os": "darwin", "cpu": "arm64" }, "sha512-rcyu0iANYfaiezKh3Mcao1O4IIgVfQldxduiL5TZT1sP0NIeRY4YReSTrzPxNnXxSYaIqaqRHMcHbUM/ic4knA=="], - "@cloudflare/workerd-linux-64": ["@cloudflare/workerd-linux-64@1.20260424.1", "", { "os": "linux", "cpu": "x64" }, "sha512-YlEBFbAYZHe/ylzl8WEYQEU/jr+0XMqXaST2oBk5oVjksdb1NGuJaggluCdZAzuJJ8UqdTmyhY5u/qrasbiFWA=="], + "@cloudflare/workerd-linux-64": ["@cloudflare/workerd-linux-64@1.20260526.1", "", { "os": "linux", "cpu": "x64" }, "sha512-5EZAEnlLwa9oGJRo8Nd3iY5Wcd9ROGNNG90xNIGp8MEjj8v2jTn42NC47fCZKFdnLj3+S+vWEhu1x0GVJnALjA=="], - "@cloudflare/workerd-linux-arm64": ["@cloudflare/workerd-linux-arm64@1.20260424.1", "", { "os": "linux", "cpu": "arm64" }, "sha512-qJ0X0m6cL8fWDUPDg8K4IxYZXNJI6XbeOihqjnqKbAClrjdPDn8VUSd+z2XiCQ5NylMtMrpa/skC9UfaR6mh8g=="], + "@cloudflare/workerd-linux-arm64": ["@cloudflare/workerd-linux-arm64@1.20260526.1", "", { "os": "linux", "cpu": "arm64" }, "sha512-X/YBQXeXFeCN7QTStoWrATEBc9WKl7PIqkw/dQkjyJ72gh3rkLe0+Xkzp3wO7gtxTDQMa7NPGy1W4+sdMf8q1g=="], - "@cloudflare/workerd-windows-64": ["@cloudflare/workerd-windows-64@1.20260424.1", "", { "os": "win32", "cpu": "x64" }, "sha512-tZ7Z9qmYNAP6z1/+8r/zKbk8F8DZmpmwNzMeN+zkde2Wnhfr3FBqOkJXT/5zmli8HPoWrIXxSiyqcNDMy8V2Zg=="], + "@cloudflare/workerd-windows-64": ["@cloudflare/workerd-windows-64@1.20260526.1", "", { "os": "win32", "cpu": "x64" }, "sha512-R+tqpFFdcfZIljx8fIW9rj9fRTtDgfoA2yonsfAGa6e8snrmr+38mdFHtkRC0D3UyZpn/hOtmXiUBfdX2gMR7Q=="], "@cloudflare/workers-types": ["@cloudflare/workers-types@4.20260415.1", "", {}, "sha512-9sEq9cZzr4s075U/TfjvdSmiX+u2NMOAIcFcCfd24FDtPfR7Iw3SbuQxkcgtpx/Bvg0au9PmQ0ZJfBaIitG0gw=="], @@ -1398,6 +1438,8 @@ "@executor-js/execution": ["@executor-js/execution@workspace:packages/core/execution"], + "@executor-js/host-cloudflare": ["@executor-js/host-cloudflare@workspace:apps/host-cloudflare"], + "@executor-js/host-mcp": ["@executor-js/host-mcp@workspace:packages/hosts/mcp"], "@executor-js/host-selfhost": ["@executor-js/host-selfhost@workspace:apps/host-selfhost"], @@ -4400,6 +4442,14 @@ "rollup": ["rollup@4.60.1", "", { "dependencies": { "@types/estree": "1.0.8" }, "optionalDependencies": { "@rollup/rollup-android-arm-eabi": "4.60.1", "@rollup/rollup-android-arm64": "4.60.1", "@rollup/rollup-darwin-arm64": "4.60.1", "@rollup/rollup-darwin-x64": "4.60.1", "@rollup/rollup-freebsd-arm64": "4.60.1", "@rollup/rollup-freebsd-x64": "4.60.1", "@rollup/rollup-linux-arm-gnueabihf": "4.60.1", "@rollup/rollup-linux-arm-musleabihf": "4.60.1", "@rollup/rollup-linux-arm64-gnu": "4.60.1", "@rollup/rollup-linux-arm64-musl": "4.60.1", "@rollup/rollup-linux-loong64-gnu": "4.60.1", "@rollup/rollup-linux-loong64-musl": "4.60.1", "@rollup/rollup-linux-ppc64-gnu": "4.60.1", "@rollup/rollup-linux-ppc64-musl": "4.60.1", "@rollup/rollup-linux-riscv64-gnu": "4.60.1", "@rollup/rollup-linux-riscv64-musl": "4.60.1", "@rollup/rollup-linux-s390x-gnu": "4.60.1", "@rollup/rollup-linux-x64-gnu": "4.60.1", "@rollup/rollup-linux-x64-musl": "4.60.1", "@rollup/rollup-openbsd-x64": "4.60.1", "@rollup/rollup-openharmony-arm64": "4.60.1", "@rollup/rollup-win32-arm64-msvc": "4.60.1", "@rollup/rollup-win32-ia32-msvc": "4.60.1", "@rollup/rollup-win32-x64-gnu": "4.60.1", "@rollup/rollup-win32-x64-msvc": "4.60.1", "fsevents": "~2.3.2" }, "bin": { "rollup": "dist/bin/rollup" } }, "sha512-VmtB2rFU/GroZ4oL8+ZqXgSA38O6GR8KSIvWmEFv63pQ0G6KaBH9s07PO8XTXP4vI+3UJUEypOfjkGfmSBBR0w=="], + "rosie-skills": ["rosie-skills@0.6.4", "", { "optionalDependencies": { "rosie-skills-darwin-arm64": "0.6.4", "rosie-skills-freebsd-x64": "0.6.4", "rosie-skills-linux-x64": "0.6.4" }, "bin": { "rosie-skills": "dist/bin.js" } }, "sha512-ojfhSiQRdZ2QyWbmKAHOSAUbaLYrTc5zIH7mS1jKoP8KCFSQddwVhMyFqldckTeybTfW3zNcsZzyOTzGTN1SBA=="], + + "rosie-skills-darwin-arm64": ["rosie-skills-darwin-arm64@0.6.4", "", { "os": "darwin", "cpu": "arm64" }, "sha512-rn1s5hqFKcxeiDEWWoFa1hdGPshR8TkwHLzy/cBavb9XJNAaUxbe3oQ78W9sQkRHAgRyzJYyk9tw68Qrdnizgg=="], + + "rosie-skills-freebsd-x64": ["rosie-skills-freebsd-x64@0.6.4", "", { "os": "freebsd", "cpu": "x64" }, "sha512-SxCRduPBMtfjkQ+q56Yw9OLA3PyaqoALzt7kER7IDKuUVfM2O/1w8sa5xhTDiCvWkZJixnH5d5Ya6KT+/Mwcng=="], + + "rosie-skills-linux-x64": ["rosie-skills-linux-x64@0.6.4", "", { "os": "linux", "cpu": "x64" }, "sha512-D9Y9mfu7goB0s0X59uU3hcFeUTef3VbpCIDwFMzyvJrAq3XhRACWBDMHQsHlyWdHxTXPX/ILyW65RXyrJlgqng=="], + "rou3": ["rou3@0.6.3", "", {}, "sha512-1HSG1ENTj7Kkm5muMnXuzzfdDOf7CFnbSYFA+H3Fp/rB9lOCxCPgy1jlZxTKyFoC5jJay8Mmc+VbPLYRjzYLrA=="], "roughjs": ["roughjs@4.6.6", "", { "dependencies": { "hachure-fill": "^0.5.2", "path-data-parser": "^0.1.0", "points-on-curve": "^0.2.0", "points-on-path": "^0.2.1" } }, "sha512-ZUz/69+SYpFN/g/lUlo2FXcIjRkSu3nDarreVdGGndHEBJ6cXPdKguS8JGxwj5HA5xIbVKSmLgr5b3AWxtRfvQ=="], @@ -4826,9 +4876,9 @@ "window-size": ["window-size@1.1.1", "", { "dependencies": { "define-property": "^1.0.0", "is-number": "^3.0.0" }, "bin": { "window-size": "cli.js" } }, "sha512-5D/9vujkmVQ7pSmc0SCBmHXbkv6eaHwXEx65MywhmUMsI8sGqJ972APq1lotfcwMKPFLuCFfL8xGHLIp7jaBmA=="], - "workerd": ["workerd@1.20260424.1", "", { "optionalDependencies": { "@cloudflare/workerd-darwin-64": "1.20260424.1", "@cloudflare/workerd-darwin-arm64": "1.20260424.1", "@cloudflare/workerd-linux-64": "1.20260424.1", "@cloudflare/workerd-linux-arm64": "1.20260424.1", "@cloudflare/workerd-windows-64": "1.20260424.1" }, "bin": { "workerd": "bin/workerd" } }, "sha512-oKsB0Xo/mfkYMdSACoS06XZg09VUK4rXwHfF/1t3P++sMbwzf4UHQvMO57+zxpEB2nVrY/ZkW0bYFGq4GdAFSQ=="], + "workerd": ["workerd@1.20260526.1", "", { "optionalDependencies": { "@cloudflare/workerd-darwin-64": "1.20260526.1", "@cloudflare/workerd-darwin-arm64": "1.20260526.1", "@cloudflare/workerd-linux-64": "1.20260526.1", "@cloudflare/workerd-linux-arm64": "1.20260526.1", "@cloudflare/workerd-windows-64": "1.20260526.1" }, "bin": { "workerd": "bin/workerd" } }, "sha512-IHzymht98p10JH1zzwdCpbViAqw97HrwKl7+KfZeASFMsYSrIsAULWdPn0LRC5FTUzBpamLNyKCCKxbgXHgRHQ=="], - "wrangler": ["wrangler@4.85.0", "", { "dependencies": { "@cloudflare/kv-asset-handler": "0.4.2", "@cloudflare/unenv-preset": "2.16.1", "blake3-wasm": "2.1.5", "esbuild": "0.27.3", "miniflare": "4.20260424.0", "path-to-regexp": "6.3.0", "unenv": "2.0.0-rc.24", "workerd": "1.20260424.1" }, "optionalDependencies": { "fsevents": "~2.3.2" }, "peerDependencies": { "@cloudflare/workers-types": "^4.20260424.1" }, "optionalPeers": ["@cloudflare/workers-types"], "bin": { "wrangler": "bin/wrangler.js", "wrangler2": "bin/wrangler.js" } }, "sha512-93cwt2RPb1qdcmEgPzH7ybiLN4BIKoWpscIX6SywjHrQOeIZrQk2haoc3XMLKtQTmzapxza9OuDD+kMHpsuuhg=="], + "wrangler": ["wrangler@4.95.0", "", { "dependencies": { "@cloudflare/kv-asset-handler": "0.5.0", "@cloudflare/unenv-preset": "2.16.1", "blake3-wasm": "2.1.5", "esbuild": "0.27.3", "miniflare": "4.20260526.0", "path-to-regexp": "6.3.0", "rosie-skills": "^0.6.3", "unenv": "2.0.0-rc.24", "workerd": "1.20260526.1" }, "optionalDependencies": { "fsevents": "~2.3.2" }, "peerDependencies": { "@cloudflare/workers-types": "^4.20260526.1" }, "optionalPeers": ["@cloudflare/workers-types"], "bin": { "wrangler": "bin/wrangler.js", "wrangler2": "bin/wrangler.js" } }, "sha512-vgXzFVSCdUbeCadgVXvu8fK5tzNm8T9W+7lriyGWZMx0B1+CAdr4d8JTlZszHfgjypRAHmAxb49etZGIRD9pgg=="], "wrap-ansi": ["wrap-ansi@9.0.2", "", { "dependencies": { "ansi-styles": "^6.2.1", "string-width": "^7.0.0", "strip-ansi": "^7.1.0" } }, "sha512-42AtmgqjV+X1VpdOfyTGOYRi0/zsoLqtXQckTmqTeybT+BDIbM/Guxo7x3pE2vtpr1ok6xRqM9OpBe+Jyoqyww=="], @@ -4918,6 +4968,8 @@ "@cloudflare/vitest-pool-workers/esbuild": ["esbuild@0.27.3", "", { "optionalDependencies": { "@esbuild/aix-ppc64": "0.27.3", "@esbuild/android-arm": "0.27.3", "@esbuild/android-arm64": "0.27.3", "@esbuild/android-x64": "0.27.3", "@esbuild/darwin-arm64": "0.27.3", "@esbuild/darwin-x64": "0.27.3", "@esbuild/freebsd-arm64": "0.27.3", "@esbuild/freebsd-x64": "0.27.3", "@esbuild/linux-arm": "0.27.3", "@esbuild/linux-arm64": "0.27.3", "@esbuild/linux-ia32": "0.27.3", "@esbuild/linux-loong64": "0.27.3", "@esbuild/linux-mips64el": "0.27.3", "@esbuild/linux-ppc64": "0.27.3", "@esbuild/linux-riscv64": "0.27.3", "@esbuild/linux-s390x": "0.27.3", "@esbuild/linux-x64": "0.27.3", "@esbuild/netbsd-arm64": "0.27.3", "@esbuild/netbsd-x64": "0.27.3", "@esbuild/openbsd-arm64": "0.27.3", "@esbuild/openbsd-x64": "0.27.3", "@esbuild/openharmony-arm64": "0.27.3", "@esbuild/sunos-x64": "0.27.3", "@esbuild/win32-arm64": "0.27.3", "@esbuild/win32-ia32": "0.27.3", "@esbuild/win32-x64": "0.27.3" }, "bin": { "esbuild": "bin/esbuild" } }, "sha512-8VwMnyGCONIs6cWue2IdpHxHnAjzxnw2Zr7MkVxB2vjmQ2ivqGFb4LEG3SMnv0Gb2F/G/2yA8zUaiL1gywDCCg=="], + "@cloudflare/vitest-pool-workers/wrangler": ["wrangler@4.85.0", "", { "dependencies": { "@cloudflare/kv-asset-handler": "0.4.2", "@cloudflare/unenv-preset": "2.16.1", "blake3-wasm": "2.1.5", "esbuild": "0.27.3", "miniflare": "4.20260424.0", "path-to-regexp": "6.3.0", "unenv": "2.0.0-rc.24", "workerd": "1.20260424.1" }, "optionalDependencies": { "fsevents": "~2.3.2" }, "peerDependencies": { "@cloudflare/workers-types": "^4.20260424.1" }, "optionalPeers": ["@cloudflare/workers-types"], "bin": { "wrangler": "bin/wrangler.js", "wrangler2": "bin/wrangler.js" } }, "sha512-93cwt2RPb1qdcmEgPzH7ybiLN4BIKoWpscIX6SywjHrQOeIZrQk2haoc3XMLKtQTmzapxza9OuDD+kMHpsuuhg=="], + "@cloudflare/vitest-pool-workers/zod": ["zod@3.25.76", "", {}, "sha512-gzUt/qt81nXsFGKIFcC3YnfEAx5NkunCfnDlvuBSSFS02bcXu4Lmea0AFIUwbLWxWPx3d9p8S5QoaujKcNQxcQ=="], "@cspotcode/source-map-support/@jridgewell/trace-mapping": ["@jridgewell/trace-mapping@0.3.9", "", { "dependencies": { "@jridgewell/resolve-uri": "^3.0.3", "@jridgewell/sourcemap-codec": "^1.4.10" } }, "sha512-3Belt6tdc8bPgAtbcmdtNJlirVoTmEb5e2gC94PnkwEW9jI6CAHUeoG85tjWP5WquqfavoMtMwiG4P926ZKKuQ=="], @@ -5334,6 +5386,8 @@ "miniflare/undici": ["undici@7.24.8", "", {}, "sha512-6KQ/+QxK49Z/p3HO6E5ZCZWNnCasyZLa5ExaVYyvPxUwKtbCPMKELJOqh7EqOle0t9cH/7d2TaaTRRa6Nhs4YQ=="], + "miniflare/workerd": ["workerd@1.20260424.1", "", { "optionalDependencies": { "@cloudflare/workerd-darwin-64": "1.20260424.1", "@cloudflare/workerd-darwin-arm64": "1.20260424.1", "@cloudflare/workerd-linux-64": "1.20260424.1", "@cloudflare/workerd-linux-arm64": "1.20260424.1", "@cloudflare/workerd-windows-64": "1.20260424.1" }, "bin": { "workerd": "bin/workerd" } }, "sha512-oKsB0Xo/mfkYMdSACoS06XZg09VUK4rXwHfF/1t3P++sMbwzf4UHQvMO57+zxpEB2nVrY/ZkW0bYFGq4GdAFSQ=="], + "node-gyp/env-paths": ["env-paths@2.2.1", "", {}, "sha512-+h1lkLKhZMTYjog1VEpJNG7NZJWcuc2DDk/qsqSTRRCOXiLjeQ1d1/udrUGhqMxUgAlwKNZ0cf2uqan5GLuS2A=="], "node-gyp/undici": ["undici@6.25.0", "", {}, "sha512-ZgpWDC5gmNiuY9CnLVXEH8rl50xhRCuLNA97fAUnKi8RRuV4E6KG31pDTsLVUKnohJE0I3XDrTeEydAXRw47xg=="], @@ -5442,6 +5496,8 @@ "wrangler/esbuild": ["esbuild@0.27.3", "", { "optionalDependencies": { "@esbuild/aix-ppc64": "0.27.3", "@esbuild/android-arm": "0.27.3", "@esbuild/android-arm64": "0.27.3", "@esbuild/android-x64": "0.27.3", "@esbuild/darwin-arm64": "0.27.3", "@esbuild/darwin-x64": "0.27.3", "@esbuild/freebsd-arm64": "0.27.3", "@esbuild/freebsd-x64": "0.27.3", "@esbuild/linux-arm": "0.27.3", "@esbuild/linux-arm64": "0.27.3", "@esbuild/linux-ia32": "0.27.3", "@esbuild/linux-loong64": "0.27.3", "@esbuild/linux-mips64el": "0.27.3", "@esbuild/linux-ppc64": "0.27.3", "@esbuild/linux-riscv64": "0.27.3", "@esbuild/linux-s390x": "0.27.3", "@esbuild/linux-x64": "0.27.3", "@esbuild/netbsd-arm64": "0.27.3", "@esbuild/netbsd-x64": "0.27.3", "@esbuild/openbsd-arm64": "0.27.3", "@esbuild/openbsd-x64": "0.27.3", "@esbuild/openharmony-arm64": "0.27.3", "@esbuild/sunos-x64": "0.27.3", "@esbuild/win32-arm64": "0.27.3", "@esbuild/win32-ia32": "0.27.3", "@esbuild/win32-x64": "0.27.3" }, "bin": { "esbuild": "bin/esbuild" } }, "sha512-8VwMnyGCONIs6cWue2IdpHxHnAjzxnw2Zr7MkVxB2vjmQ2ivqGFb4LEG3SMnv0Gb2F/G/2yA8zUaiL1gywDCCg=="], + "wrangler/miniflare": ["miniflare@4.20260526.0", "", { "dependencies": { "@cspotcode/source-map-support": "0.8.1", "sharp": "^0.34.5", "undici": "7.24.8", "workerd": "1.20260526.1", "ws": "8.20.1", "youch": "4.1.0-beta.10" }, "bin": { "miniflare": "bootstrap.js" } }, "sha512-JYQ7jPZZWoaaj9jWHb8Ucp6Cu2SbDVqIsAJhumqdzzLkkfq0pYkDeino/sZfW1ixJWPjv/C44zjm9gVJC2izCA=="], + "wrap-ansi/string-width": ["string-width@7.2.0", "", { "dependencies": { "emoji-regex": "^10.3.0", "get-east-asian-width": "^1.0.0", "strip-ansi": "^7.1.0" } }, "sha512-tsaTIkKW9b4N+AEj+SVA+WhJzV7/zMhcSu78mLKWSk7cXMOSHsBKFWUs0fWwq8QyK3MgJBQRX6Gbi4kYbdvGkQ=="], "wrap-ansi/strip-ansi": ["strip-ansi@7.2.0", "", { "dependencies": { "ansi-regex": "^6.2.2" } }, "sha512-yDPMNjp4WyfYBkHnjIRLfca1i6KMyGCtsVgoKe/z1+6vukgaENdgGBZt+ZmKPc4gavvEZ5OgHfHdrazhgNyG7w=="], @@ -5462,6 +5518,8 @@ "@cloudflare/vite-plugin/miniflare/workerd": ["workerd@1.20260415.1", "", { "optionalDependencies": { "@cloudflare/workerd-darwin-64": "1.20260415.1", "@cloudflare/workerd-darwin-arm64": "1.20260415.1", "@cloudflare/workerd-linux-64": "1.20260415.1", "@cloudflare/workerd-linux-arm64": "1.20260415.1", "@cloudflare/workerd-windows-64": "1.20260415.1" }, "bin": { "workerd": "bin/workerd" } }, "sha512-phyPjRnx+mQDfkhN9ENPioL1L0SdhYs4S0YmJK/xF9Oga+ykNfdSy1MHnsOj8yqnOV96zcVQMx32dJ0r3pq0jQ=="], + "@cloudflare/vite-plugin/wrangler/@cloudflare/kv-asset-handler": ["@cloudflare/kv-asset-handler@0.4.2", "", {}, "sha512-SIOD2DxrRRwQ+jgzlXCqoEFiKOFqaPjhnNTGKXSRLvp1HiOvapLaFG2kEr9dYQTYe8rKrd9uvDUzmAITeNyaHQ=="], + "@cloudflare/vite-plugin/wrangler/esbuild": ["esbuild@0.27.3", "", { "optionalDependencies": { "@esbuild/aix-ppc64": "0.27.3", "@esbuild/android-arm": "0.27.3", "@esbuild/android-arm64": "0.27.3", "@esbuild/android-x64": "0.27.3", "@esbuild/darwin-arm64": "0.27.3", "@esbuild/darwin-x64": "0.27.3", "@esbuild/freebsd-arm64": "0.27.3", "@esbuild/freebsd-x64": "0.27.3", "@esbuild/linux-arm": "0.27.3", "@esbuild/linux-arm64": "0.27.3", "@esbuild/linux-ia32": "0.27.3", "@esbuild/linux-loong64": "0.27.3", "@esbuild/linux-mips64el": "0.27.3", "@esbuild/linux-ppc64": "0.27.3", "@esbuild/linux-riscv64": "0.27.3", "@esbuild/linux-s390x": "0.27.3", "@esbuild/linux-x64": "0.27.3", "@esbuild/netbsd-arm64": "0.27.3", "@esbuild/netbsd-x64": "0.27.3", "@esbuild/openbsd-arm64": "0.27.3", "@esbuild/openbsd-x64": "0.27.3", "@esbuild/openharmony-arm64": "0.27.3", "@esbuild/sunos-x64": "0.27.3", "@esbuild/win32-arm64": "0.27.3", "@esbuild/win32-ia32": "0.27.3", "@esbuild/win32-x64": "0.27.3" }, "bin": { "esbuild": "bin/esbuild" } }, "sha512-8VwMnyGCONIs6cWue2IdpHxHnAjzxnw2Zr7MkVxB2vjmQ2ivqGFb4LEG3SMnv0Gb2F/G/2yA8zUaiL1gywDCCg=="], "@cloudflare/vite-plugin/wrangler/workerd": ["workerd@1.20260415.1", "", { "optionalDependencies": { "@cloudflare/workerd-darwin-64": "1.20260415.1", "@cloudflare/workerd-darwin-arm64": "1.20260415.1", "@cloudflare/workerd-linux-64": "1.20260415.1", "@cloudflare/workerd-linux-arm64": "1.20260415.1", "@cloudflare/workerd-windows-64": "1.20260415.1" }, "bin": { "workerd": "bin/workerd" } }, "sha512-phyPjRnx+mQDfkhN9ENPioL1L0SdhYs4S0YmJK/xF9Oga+ykNfdSy1MHnsOj8yqnOV96zcVQMx32dJ0r3pq0jQ=="], @@ -5518,6 +5576,10 @@ "@cloudflare/vitest-pool-workers/esbuild/@esbuild/win32-x64": ["@esbuild/win32-x64@0.27.3", "", { "os": "win32", "cpu": "x64" }, "sha512-4uJGhsxuptu3OcpVAzli+/gWusVGwZZHTlS63hh++ehExkVT8SgiEf7/uC/PclrPPkLhZqGgCTjd0VWLo6xMqA=="], + "@cloudflare/vitest-pool-workers/wrangler/@cloudflare/kv-asset-handler": ["@cloudflare/kv-asset-handler@0.4.2", "", {}, "sha512-SIOD2DxrRRwQ+jgzlXCqoEFiKOFqaPjhnNTGKXSRLvp1HiOvapLaFG2kEr9dYQTYe8rKrd9uvDUzmAITeNyaHQ=="], + + "@cloudflare/vitest-pool-workers/wrangler/workerd": ["workerd@1.20260424.1", "", { "optionalDependencies": { "@cloudflare/workerd-darwin-64": "1.20260424.1", "@cloudflare/workerd-darwin-arm64": "1.20260424.1", "@cloudflare/workerd-linux-64": "1.20260424.1", "@cloudflare/workerd-linux-arm64": "1.20260424.1", "@cloudflare/workerd-windows-64": "1.20260424.1" }, "bin": { "workerd": "bin/workerd" } }, "sha512-oKsB0Xo/mfkYMdSACoS06XZg09VUK4rXwHfF/1t3P++sMbwzf4UHQvMO57+zxpEB2nVrY/ZkW0bYFGq4GdAFSQ=="], + "@develar/schema-utils/ajv/json-schema-traverse": ["json-schema-traverse@0.4.1", "", {}, "sha512-xbbCH5dCYU5T8LcEhhuh7HJ88HXuW3qsI3Y0zOZFKfZEHcpWiHU/Jxzk629Brsab/mMiHQti9wMP+845RPe3Vg=="], "@electron/asar/minimatch/brace-expansion": ["brace-expansion@1.1.14", "", { "dependencies": { "balanced-match": "^1.0.0", "concat-map": "0.0.1" } }, "sha512-MWPGfDxnyzKU7rNOW9SP/c50vi3xrmrua/+6hfPbCS2ABNWfx24vPidzvC7krjU/RTo235sV776ymlsMtGKj8g=="], @@ -5848,6 +5910,16 @@ "mimetext/mime-types/mime-db": ["mime-db@1.52.0", "", {}, "sha512-sPU4uV7dYlvtWJxwwxHD0PuihVNiE7TyAbQ5SWxDCB9mUYvOgroQOwYQQOKPJ8CIbE+1ETVlOoK1UC2nU3gYvg=="], + "miniflare/workerd/@cloudflare/workerd-darwin-64": ["@cloudflare/workerd-darwin-64@1.20260424.1", "", { "os": "darwin", "cpu": "x64" }, "sha512-yFR1XaJbSDLg/qbwtrYaU2xwFXatIPKR5nrMQCN1q/m6+Qe/j6r+kCnFEvOJjMZOm9iCKsE6Qly5clgl4u32qw=="], + + "miniflare/workerd/@cloudflare/workerd-darwin-arm64": ["@cloudflare/workerd-darwin-arm64@1.20260424.1", "", { "os": "darwin", "cpu": "arm64" }, "sha512-LqWKcE7x/9KyC2iQvKPeb20hKST3dYXDZlYTvFymgR1DfLS0OFOCzVGTloVNd7WqvK4SkdzBYfxo7QMIAeBK0w=="], + + "miniflare/workerd/@cloudflare/workerd-linux-64": ["@cloudflare/workerd-linux-64@1.20260424.1", "", { "os": "linux", "cpu": "x64" }, "sha512-YlEBFbAYZHe/ylzl8WEYQEU/jr+0XMqXaST2oBk5oVjksdb1NGuJaggluCdZAzuJJ8UqdTmyhY5u/qrasbiFWA=="], + + "miniflare/workerd/@cloudflare/workerd-linux-arm64": ["@cloudflare/workerd-linux-arm64@1.20260424.1", "", { "os": "linux", "cpu": "arm64" }, "sha512-qJ0X0m6cL8fWDUPDg8K4IxYZXNJI6XbeOihqjnqKbAClrjdPDn8VUSd+z2XiCQ5NylMtMrpa/skC9UfaR6mh8g=="], + + "miniflare/workerd/@cloudflare/workerd-windows-64": ["@cloudflare/workerd-windows-64@1.20260424.1", "", { "os": "win32", "cpu": "x64" }, "sha512-tZ7Z9qmYNAP6z1/+8r/zKbk8F8DZmpmwNzMeN+zkde2Wnhfr3FBqOkJXT/5zmli8HPoWrIXxSiyqcNDMy8V2Zg=="], + "node-gyp/which/isexe": ["isexe@4.0.0", "", {}, "sha512-FFUtZMpoZ8RqHS3XeXEmHWLA4thH+ZxCv2lOiPIn1Xc7CxrqhWzNSDzD+/chS/zbYezmiwWLdQC09JdQKmthOw=="], "ora/cli-cursor/restore-cursor": ["restore-cursor@5.1.0", "", { "dependencies": { "onetime": "^7.0.0", "signal-exit": "^4.1.0" } }, "sha512-oMA2dcrw6u0YfxJQXm342bFKX/E4sG9rbTzO9ptUcR/e8A33cHuvStiYOwH7fszkZlZ1z/ta9AAoPk2F4qIOHA=="], @@ -5948,6 +6020,10 @@ "wrangler/esbuild/@esbuild/win32-x64": ["@esbuild/win32-x64@0.27.3", "", { "os": "win32", "cpu": "x64" }, "sha512-4uJGhsxuptu3OcpVAzli+/gWusVGwZZHTlS63hh++ehExkVT8SgiEf7/uC/PclrPPkLhZqGgCTjd0VWLo6xMqA=="], + "wrangler/miniflare/undici": ["undici@7.24.8", "", {}, "sha512-6KQ/+QxK49Z/p3HO6E5ZCZWNnCasyZLa5ExaVYyvPxUwKtbCPMKELJOqh7EqOle0t9cH/7d2TaaTRRa6Nhs4YQ=="], + + "wrangler/miniflare/ws": ["ws@8.20.1", "", { "peerDependencies": { "bufferutil": "^4.0.1", "utf-8-validate": ">=5.0.2" }, "optionalPeers": ["bufferutil", "utf-8-validate"] }, "sha512-It4dO0K5v//JtTXuPkfEOaI3uUN87iYPnqo/ZzqCoG3g8uhA66QUMs/SrM0YK7/NAu+r4LMh/9dq2A7k+rHs+w=="], + "wrap-ansi-cjs/string-width/is-fullwidth-code-point": ["is-fullwidth-code-point@3.0.0", "", {}, "sha512-zymm5+u+sCsSWyD9qNaejV3DFvhCKclKdizYaJUuHA83RLjb7nSuGnddCHGv0hk+KY7BMAlsWeK4Ueg6EV6XQg=="], "wrap-ansi/string-width/emoji-regex": ["emoji-regex@10.6.0", "", {}, "sha512-toUI84YS5YmxW219erniWD0CIVOo46xGKColeNQRgOzDorgBi1v4D71/OFzgD9GO2UGKIv1C3Sp8DAn0+j5w7A=="], @@ -6028,6 +6104,16 @@ "@cloudflare/vite-plugin/wrangler/workerd/@cloudflare/workerd-windows-64": ["@cloudflare/workerd-windows-64@1.20260415.1", "", { "os": "win32", "cpu": "x64" }, "sha512-4NuMLlerI0Ijua3Ir8HXQ+qyNvCUDEG5gDco5Om+sAiK6rnWiz+aGoSlbB8W16yW9QAgzCstbmXLiVknUBflfQ=="], + "@cloudflare/vitest-pool-workers/wrangler/workerd/@cloudflare/workerd-darwin-64": ["@cloudflare/workerd-darwin-64@1.20260424.1", "", { "os": "darwin", "cpu": "x64" }, "sha512-yFR1XaJbSDLg/qbwtrYaU2xwFXatIPKR5nrMQCN1q/m6+Qe/j6r+kCnFEvOJjMZOm9iCKsE6Qly5clgl4u32qw=="], + + "@cloudflare/vitest-pool-workers/wrangler/workerd/@cloudflare/workerd-darwin-arm64": ["@cloudflare/workerd-darwin-arm64@1.20260424.1", "", { "os": "darwin", "cpu": "arm64" }, "sha512-LqWKcE7x/9KyC2iQvKPeb20hKST3dYXDZlYTvFymgR1DfLS0OFOCzVGTloVNd7WqvK4SkdzBYfxo7QMIAeBK0w=="], + + "@cloudflare/vitest-pool-workers/wrangler/workerd/@cloudflare/workerd-linux-64": ["@cloudflare/workerd-linux-64@1.20260424.1", "", { "os": "linux", "cpu": "x64" }, "sha512-YlEBFbAYZHe/ylzl8WEYQEU/jr+0XMqXaST2oBk5oVjksdb1NGuJaggluCdZAzuJJ8UqdTmyhY5u/qrasbiFWA=="], + + "@cloudflare/vitest-pool-workers/wrangler/workerd/@cloudflare/workerd-linux-arm64": ["@cloudflare/workerd-linux-arm64@1.20260424.1", "", { "os": "linux", "cpu": "arm64" }, "sha512-qJ0X0m6cL8fWDUPDg8K4IxYZXNJI6XbeOihqjnqKbAClrjdPDn8VUSd+z2XiCQ5NylMtMrpa/skC9UfaR6mh8g=="], + + "@cloudflare/vitest-pool-workers/wrangler/workerd/@cloudflare/workerd-windows-64": ["@cloudflare/workerd-windows-64@1.20260424.1", "", { "os": "win32", "cpu": "x64" }, "sha512-tZ7Z9qmYNAP6z1/+8r/zKbk8F8DZmpmwNzMeN+zkde2Wnhfr3FBqOkJXT/5zmli8HPoWrIXxSiyqcNDMy8V2Zg=="], + "@electron/asar/minimatch/brace-expansion/balanced-match": ["balanced-match@1.0.2", "", {}, "sha512-3oSeUO0TMV67hN1AmbXsK4yaqU7tjiHlbxRDZOpH0KW9+CeX4bRAaX0Anxt0tx2MrpRpWwQaPwIlISEJhYU5Pw=="], "@electron/universal/minimatch/brace-expansion/balanced-match": ["balanced-match@1.0.2", "", {}, "sha512-3oSeUO0TMV67hN1AmbXsK4yaqU7tjiHlbxRDZOpH0KW9+CeX4bRAaX0Anxt0tx2MrpRpWwQaPwIlISEJhYU5Pw=="], diff --git a/docs/docs.json b/docs/docs.json index 5c0c62ae9..31d5a14d9 100644 --- a/docs/docs.json +++ b/docs/docs.json @@ -87,6 +87,15 @@ ] } ] + }, + { + "tab": "Self-Host", + "groups": [ + { + "group": "Self-Host", + "pages": ["self-hosting/guide"] + } + ] } ] } diff --git a/docs/self-hosting/guide.mdx b/docs/self-hosting/guide.mdx new file mode 100644 index 000000000..b114a986b --- /dev/null +++ b/docs/self-hosting/guide.mdx @@ -0,0 +1,117 @@ +--- +title: Self-Hosting +description: Run Executor on your own infrastructure in a single container. +--- + +Executor self-hosts as **one container** — the database (SQLite/libSQL), the +QuickJS code sandbox, and the MCP server all run in-process. There is no separate +database, worker, or proxy to operate, and no required configuration: a bare +`docker compose up` boots a working instance and walks you through creating the +admin account in the browser. + +## Quick start + +From a clone of the repository: + +```bash +cd apps/host-selfhost +docker compose up -d --build +``` + +Then open [http://localhost:4788](http://localhost:4788). On a fresh instance +you'll see a **setup screen** — create the first admin account, and you're in. + +That's the whole install. The container persists its data (database and +generated keys) in the `executor-data` volume, so it survives restarts and +upgrades. + +### Without compose + +The compose file just wraps the Dockerfile. To build and run it directly: + +```bash +# Build context is the repo root (the Bun workspace install needs every member). +docker build -f apps/host-selfhost/Dockerfile -t executor-selfhost . + +docker run -d -p 4788:4788 -v executor-data:/data executor-selfhost +``` + +## First-run setup + +The **first person to open the instance creates the admin account** — no +environment variables, no passwords in logs. That account becomes the owner of +the instance's single organization. Once it exists, the setup screen is replaced +by sign-in, and self-service signup is closed. + +If you'd rather provision the admin ahead of time (CI / infra-as-code), set +**both** `EXECUTOR_BOOTSTRAP_ADMIN_EMAIL` and `EXECUTOR_BOOTSTRAP_ADMIN_PASSWORD` +before first boot; the instance then skips the browser setup and creates that +admin as the owner. + +## Inviting people + +Open signup is off — after the first admin, people join by redeeming an +**invite link**. + +1. Sign in as the admin and open **Admin** in the nav. +2. Under **Invite links**, create a link (optionally with a label and a role). +3. Send the `/join/` link to the person however you like — Slack, email, + in person. The link itself is the credential; no mail server is involved. +4. They open it, pick their own name/email/password, and land in the + organization. Each link is **single-use** and can be revoked while pending. + +From the same Admin page you can change a member's role or remove them. + +## Configuration + +Every setting is optional. Put overrides in `apps/host-selfhost/.env` (compose +loads it automatically) or pass them as `-e` flags to `docker run`. See +`.env.example` for the full list. + +| Variable | Default | Purpose | +| ---------------------------------------------------------------------- | --------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | +| `EXECUTOR_WEB_BASE_URL` | `http://localhost:4788` | The public URL browsers use to reach the instance. Must match exactly (scheme + host + port) or browser logins are rejected. Set this when serving behind a domain / TLS. | +| `BETTER_AUTH_SECRET` | generated + persisted | Session secret. Auto-generated under the data volume if unset; set it (≥ 32 chars) to manage it yourself. Rotating it signs everyone out. | +| `EXECUTOR_BOOTSTRAP_ADMIN_EMAIL` / `EXECUTOR_BOOTSTRAP_ADMIN_PASSWORD` | unset | Set **both** to pre-create the admin instead of the browser setup. | +| `EXECUTOR_ORG_NAME` / `EXECUTOR_ORG_SLUG` | `Default` / `default` | Name and slug for the single organization. | +| `EXECUTOR_ALLOW_LOCAL_NETWORK` | `false` | Allow sandboxed code to reach loopback / private network addresses. Off by default. | +| `PORT` / `EXECUTOR_HOST` | `4788` / `0.0.0.0` (in the image) | Bind port and address. | +| `EXECUTOR_DATA_DIR` | `/data` (in the image) | Where the database and keys live. | + +## Reverse proxy and HTTPS + +For anything beyond a local trial, terminate TLS at a reverse proxy (Caddy, +nginx, Traefik) in front of the container and set `EXECUTOR_WEB_BASE_URL` to your +public `https://…` URL. That value must match the address users actually load — +it's what cookie-based browser logins are checked against. + +The container exposes `GET /api/health` (a readiness probe used by the built-in +Docker healthcheck) if your proxy or orchestrator wants one. + +## Backup and restore + +All state lives in the data volume (`/data`): the SQLite database plus the +generated secret keys. Back it up by copying that directory while the container +is stopped (or with your volume tooling): + +```bash +docker compose stop +docker run --rm -v executor-data:/data -v "$PWD":/backup busybox \ + tar czf /backup/executor-backup.tgz -C /data . +docker compose start +``` + +Restore by extracting the archive back into a fresh `executor-data` volume +before starting the container. Keep the backup safe: it contains your secret +keys as well as your data. + +## Upgrading + +```bash +cd apps/host-selfhost +git pull +docker compose up -d --build +``` + +The data volume is reused, so your database and accounts carry over. Schema +migrations run idempotently at boot. diff --git a/packages/core/fumadb/src/adapters/drizzle/index.ts b/packages/core/fumadb/src/adapters/drizzle/index.ts index 3a096793b..da2901386 100644 --- a/packages/core/fumadb/src/adapters/drizzle/index.ts +++ b/packages/core/fumadb/src/adapters/drizzle/index.ts @@ -24,16 +24,25 @@ export interface DrizzleConfig { */ db: unknown; provider: Exclude; + /** + * Whether the underlying engine supports interactive transactions + * (BEGIN/COMMIT or the driver's `.transaction()`). Defaults to `true`. + * Set `false` for Cloudflare D1, which rejects interactive transactions — + * the adapter then runs transaction callbacks directly (auto-commit per + * statement, no atomic rollback). + */ + interactiveTransactions?: boolean; } export function drizzleAdapter(options: DrizzleConfig): FumaDBAdapter { const settingsTableName = (namespace: string) => `private_${namespace}_settings`; + const interactiveTransactions = options.interactiveTransactions ?? true; return { name: "drizzle", createORM(schema) { - return fromDrizzle(schema, options.db, options.provider); + return fromDrizzle(schema, options.db, options.provider, interactiveTransactions); }, // assume the database is sync with Drizzle schema async getSchemaVersion() { diff --git a/packages/core/fumadb/src/adapters/drizzle/query.ts b/packages/core/fumadb/src/adapters/drizzle/query.ts index 34abb3b95..eb502d5c7 100644 --- a/packages/core/fumadb/src/adapters/drizzle/query.ts +++ b/packages/core/fumadb/src/adapters/drizzle/query.ts @@ -169,7 +169,8 @@ function mapQueryResult(table: AnyTable, result: Record) { export function fromDrizzle( schema: AnySchema, _db: unknown, - provider: SQLProvider + provider: SQLProvider, + interactiveTransactions: boolean = true ): AbstractQuery { const [db, drizzleTables] = parseDrizzle(_db); @@ -392,10 +393,19 @@ export function fromDrizzle( await query; }, async transaction(run) { + // Some SQLite-compatible engines (Cloudflare D1) reject interactive + // transactions — both raw BEGIN/COMMIT and the driver's `.transaction()`. + // When disabled, run the operations directly against the same connection: + // each statement auto-commits, so there is no atomic rollback (the + // engine's constraint, not ours). libSQL/Postgres keep real transactions. + if (!interactiveTransactions) { + return run(fromDrizzle(schema, _db, provider, interactiveTransactions)); + } + if (provider === "sqlite") { await executeRaw("BEGIN"); try { - const result = await run(fromDrizzle(schema, _db, provider)); + const result = await run(fromDrizzle(schema, _db, provider, interactiveTransactions)); await executeRaw("COMMIT"); return result; } catch (e) { @@ -404,7 +414,9 @@ export function fromDrizzle( } } - return db.transaction((tx) => run(fromDrizzle(schema, tx, provider))); + return db.transaction((tx) => + run(fromDrizzle(schema, tx, provider, interactiveTransactions)) + ); }, }); } diff --git a/packages/core/sdk/src/executor-fuma-db.ts b/packages/core/sdk/src/executor-fuma-db.ts index 56ee1dce8..51267b73b 100644 --- a/packages/core/sdk/src/executor-fuma-db.ts +++ b/packages/core/sdk/src/executor-fuma-db.ts @@ -44,6 +44,14 @@ export interface CreateExecutorFumaDbOptions( drizzleAdapter({ db: drizzleDb, provider: options.provider, + interactiveTransactions: options.interactiveTransactions, }), ); diff --git a/packages/hosts/mcp/package.json b/packages/hosts/mcp/package.json index 39c656d05..3b0364318 100644 --- a/packages/hosts/mcp/package.json +++ b/packages/hosts/mcp/package.json @@ -11,6 +11,10 @@ "./tool-server": { "types": "./src/tool-server.ts", "default": "./src/tool-server.ts" + }, + "./in-memory-session-store": { + "types": "./src/in-memory-session-store.ts", + "default": "./src/in-memory-session-store.ts" } }, "scripts": { diff --git a/packages/hosts/mcp/src/in-memory-session-store.ts b/packages/hosts/mcp/src/in-memory-session-store.ts new file mode 100644 index 000000000..d22f8a16a --- /dev/null +++ b/packages/hosts/mcp/src/in-memory-session-store.ts @@ -0,0 +1,187 @@ +import { Data, Effect, Layer } from "effect"; +import type { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js"; +import { WebStandardStreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/webStandardStreamableHttp.js"; + +import { jsonRpcErrorBody } from "./envelope"; +import { + McpSessionStore, + principalOwns, + type McpDispatchInput, + type McpDispatchResult, + type Principal, +} from "./seams"; + +// --------------------------------------------------------------------------- +// In-process McpSessionStore — the single-node serving store, shared by every +// host that has no cross-isolate session backend (self-host, the Cloudflare +// QuickJS host). Cloud's Durable Object store is the cross-isolate variant of +// the same `McpSessionStore` seam. +// +// In the two-seam envelope the store owns the ENTIRE session lifecycle via +// `dispatch`: create (no session id + POST initialize), forward (session id +// present), and ownership (cross-bearer). Three Maps keyed by mcp-session-id — +// transports, servers, owners — hold the live in-process sessions. Closing a +// session is just closing its transport + server. +// +// The engine is a store implementation detail, not an envelope seam: the store +// builds each per-session `McpServer` through the host-supplied `buildServer` +// (the host's execution stack over its own DB + code substrate). The two-seam +// envelope has no engine seam — the store owns engine construction. +// +// `dispatch` returns the transport `Response` to pass through, or: +// - "not-found" (unknown session id) -> envelope renders 404 -32001 +// - "forbidden" (session owned by another bearer) -> envelope renders 403 -32003 +// --------------------------------------------------------------------------- + +/** Engine construction failed for a principal. The store surfaces it as a 500. */ +export class McpEngineBuildError extends Data.TaggedError("McpEngineBuildError")<{ + readonly cause: unknown; +}> {} + +/** Build the per-session `McpServer` for a principal (the host's engine + tools). */ +export type McpBuildServer = ( + principal: Principal, +) => Effect.Effect; + +export interface InMemoryMcpSessionStore { + /** The `McpSessionStore` seam value to hand to `inMemoryMcpSessionsLayer`. */ + readonly store: McpSessionStore["Service"]; + /** Dispose every live session — wire into the host's shutdown (not a seam). */ + readonly close: () => Promise; +} + +const ignoreClose = (close: (() => Promise) | undefined): Promise => + close + ? Effect.runPromise(Effect.ignore(Effect.tryPromise({ try: close, catch: () => undefined }))) + : Promise.resolve(); + +const formatBoundaryError = (error: unknown): unknown => + // oxlint-disable-next-line executor/no-instanceof-error, executor/no-unknown-error-message -- boundary: log unknown MCP SDK/runtime failures + error instanceof Error ? (error.stack ?? error.message) : error; + +// The store's error bodies are INNER responses (no CORS): the serving envelope +// re-wraps the store `Response` with CORS before it leaves the origin, so the +// canonical renderer is called with `cors: false` (content-type only). +const jsonRpcError = (status: number, code: number, message: string): Response => + jsonRpcErrorBody(status, code, message, { cors: false }); + +/** + * Build the in-process session store plus an explicit `close()` that disposes + * all live sessions. `close()` is not part of the seam — it is the host lifetime + * hook the envelope doesn't own. Each per-session engine comes from the + * host-supplied `buildServer`. + */ +export const makeInMemoryMcpSessionStore = ( + buildServer: McpBuildServer, +): InMemoryMcpSessionStore => { + const transports = new Map(); + const servers = new Map(); + const owners = new Map(); + + const dispose = async (id: string, opts: { transport?: boolean; server?: boolean } = {}) => { + const transport = transports.get(id); + const server = servers.get(id); + transports.delete(id); + servers.delete(id); + owners.delete(id); + if (opts.transport) await ignoreClose(transport ? () => transport.close() : undefined); + if (opts.server) await ignoreClose(server ? () => server.close() : undefined); + }; + + /** + * Drive a transport for one web request, recovering any defect to a 500. On a + * fresh transport that never minted a session id (e.g. a non-initialize first + * request), close it and its server eagerly so they don't leak. + */ + const runHandleRequest = ( + transport: WebStandardStreamableHTTPServerTransport, + request: Request, + onClose?: () => void, + ): Effect.Effect => { + const finish = (): void => { + if (onClose && !transport.sessionId) onClose(); + }; + return Effect.promise(() => transport.handleRequest(request)).pipe( + Effect.tap(() => Effect.sync(finish)), + Effect.catchCause((cause) => + Effect.sync(() => { + console.error("[mcp] handleRequest error:", formatBoundaryError(cause)); + finish(); + return jsonRpcError(500, -32603, "Internal server error"); + }), + ), + ); + }; + + /** Forward to an existing session, enforcing ownership against the principal. */ + const forward = ( + sessionId: string, + principal: Principal, + request: Request, + ): Effect.Effect => { + const transport = transports.get(sessionId); + const owner = owners.get(sessionId); + if (!transport || !owner) return Effect.succeed("not-found"); + if (!principalOwns(owner, principal)) return Effect.succeed("forbidden"); + return runHandleRequest(transport, request); + }; + + /** Open a new session: build the server, connect a transport, drive the request. */ + const create = (principal: Principal, request: Request): Effect.Effect => + buildServer(principal).pipe( + Effect.flatMap((server) => + Effect.gen(function* () { + const transport = new WebStandardStreamableHTTPServerTransport({ + sessionIdGenerator: () => crypto.randomUUID(), + enableJsonResponse: true, + onsessioninitialized: (sid) => { + transports.set(sid, transport); + servers.set(sid, server); + owners.set(sid, principal); + }, + onsessionclosed: (sid) => void dispose(sid, { server: true }), + }); + transport.onclose = () => { + const sid = transport.sessionId; + if (sid) void dispose(sid, { server: true }); + }; + yield* Effect.promise(() => server.connect(transport)); + // The session id is minted on the first (initialize) request, so we + // drive `handleRequest` here; if no id results we close eagerly. + return yield* runHandleRequest(transport, request, () => { + void ignoreClose(() => transport.close()); + void ignoreClose(() => server.close()); + }); + }), + ), + // A build failure has nowhere typed to go in the envelope; render a 500. + Effect.catchTag("McpEngineBuildError", () => + Effect.succeed(jsonRpcError(500, -32603, "Internal server error")), + ), + ); + + const store: McpSessionStore["Service"] = { + dispatch: ({ request, principal, sessionId }: McpDispatchInput) => + sessionId ? forward(sessionId, principal, request) : create(principal, request), + dispose: (sessionId) => + Effect.promise(() => dispose(sessionId, { transport: true, server: true })), + }; + + return { + store, + close: async () => { + const ids = new Set([...transports.keys(), ...servers.keys()]); + await Promise.all([...ids].map((id) => dispose(id, { transport: true, server: true }))); + }, + }; +}; + +/** + * Layer wrapping a freshly built in-process store, the `McpSessionStore` + * envelope seam. The owning app calls `makeInMemoryMcpSessionStore(buildServer)` + * directly so it can wire the `close()` lifetime hook into shutdown, then passes + * the built store here. + */ +export const inMemoryMcpSessionsLayer = ( + built: InMemoryMcpSessionStore, +): Layer.Layer => Layer.succeed(McpSessionStore)(built.store); diff --git a/packages/plugins/openapi/src/sdk/plugin.ts b/packages/plugins/openapi/src/sdk/plugin.ts index 6a4d6e078..0f6288de3 100644 --- a/packages/plugins/openapi/src/sdk/plugin.ts +++ b/packages/plugins/openapi/src/sdk/plugin.ts @@ -1182,6 +1182,16 @@ const toOpenApiSourceConfig = ( } return { kind: "openapi", + // TODO(storage): the entire resolved spec is inlined into the persisted + // source config (and thus a single plugin_storage row). Large specs (e.g. + // Vercel's ~7MB) exceed per-value limits on some backends (Cloudflare D1 + // caps a value at ~1-2MB -> SQLITE_TOOBIG). It should instead be written + // through the executor's `blobs` (BlobStore) seam, storing only a reference + // here, so large specs live in object storage (R2/S3/filesystem) rather than + // a relational row. For `kind: "url"` sources the spec is also re-fetchable, + // so we could store just the URL + a content hash and rehydrate on refresh. + // (The Cloudflare host currently works around this with an R2 offload wrapper + // in apps/host-cloudflare/src/db; this is the proper plugin-level fix.) spec: specInputToConfigString(config.spec), baseUrl: config.baseUrl, namespace, diff --git a/packages/react/src/components/sonner.tsx b/packages/react/src/components/sonner.tsx index 2e324e65b..ed466c377 100644 --- a/packages/react/src/components/sonner.tsx +++ b/packages/react/src/components/sonner.tsx @@ -7,7 +7,7 @@ import { OctagonXIcon, TriangleAlertIcon, } from "lucide-react"; -import { Toaster as Sonner, type ToasterProps } from "sonner"; +import { Toaster as Sonner, toast, type ToasterProps } from "sonner"; const Toaster = ({ ...props }: ToasterProps) => { return ( @@ -34,4 +34,4 @@ const Toaster = ({ ...props }: ToasterProps) => { ); }; -export { Toaster }; +export { Toaster, toast }; From 59ad872f86b8e174bc84622b4c4e54c6dfdd2122 Mon Sep 17 00:00:00 2001 From: Rhys Sullivan Date: Sun, 31 May 2026 02:30:27 -0700 Subject: [PATCH 04/31] fumadb: batch createMany by bound-parameter count Multi-row inserts bind rows*columns parameters in one statement. Engines that cap bound parameters per query (Cloudflare D1: 100) overflowed with "too many SQL variables" on wide tables (e.g. deriving 300+ tools from a large OpenAPI spec). The drizzle adapter gains a maxBoundParameters option (threaded through createExecutorFumaDb and every nested transaction-scoped fromDrizzle); when set, createMany sizes batches so rows*columns stays within it. Unset for libSQL/Postgres (no tight cap). host-cloudflare sets 100. With this plus the R2 large-value offload and the no-interactive-transactions path, a 7MB OpenAPI spec (Vercel, 309 tools) now adds cleanly on D1. --- apps/host-cloudflare/src/db/d1.ts | 4 ++++ .../core/fumadb/src/adapters/drizzle/index.ts | 15 ++++++++++++- .../core/fumadb/src/adapters/drizzle/query.ts | 22 ++++++++++++++----- packages/core/sdk/src/executor-fuma-db.ts | 7 ++++++ 4 files changed, 41 insertions(+), 7 deletions(-) diff --git a/apps/host-cloudflare/src/db/d1.ts b/apps/host-cloudflare/src/db/d1.ts index e6270aacd..d0b4c592c 100644 --- a/apps/host-cloudflare/src/db/d1.ts +++ b/apps/host-cloudflare/src/db/d1.ts @@ -60,6 +60,10 @@ export const createD1ExecutorDb = async ( const { db: fumaDb, fuma } = createExecutorFumaDb(drizzleDb, { ...options, interactiveTransactions: false, + // D1 caps bound parameters at 100 per query; createMany batches to fit + // (otherwise a wide table like `tool` overflows with "too many SQL + // variables" when a source derives many tools). + maxBoundParameters: 100, }); return { diff --git a/packages/core/fumadb/src/adapters/drizzle/index.ts b/packages/core/fumadb/src/adapters/drizzle/index.ts index da2901386..a87ff3f51 100644 --- a/packages/core/fumadb/src/adapters/drizzle/index.ts +++ b/packages/core/fumadb/src/adapters/drizzle/index.ts @@ -32,6 +32,13 @@ export interface DrizzleConfig { * statement, no atomic rollback). */ interactiveTransactions?: boolean; + /** + * Maximum bound parameters per query the engine accepts. When set, multi-row + * `createMany` inserts are batched so `rows * columns` stays within it. + * Cloudflare D1 caps this at 100; libSQL/Postgres leave it unset (no tight + * cap), keeping the row-count batch. + */ + maxBoundParameters?: number; } export function drizzleAdapter(options: DrizzleConfig): FumaDBAdapter { @@ -42,7 +49,13 @@ export function drizzleAdapter(options: DrizzleConfig): FumaDBAdapter { return { name: "drizzle", createORM(schema) { - return fromDrizzle(schema, options.db, options.provider, interactiveTransactions); + return fromDrizzle( + schema, + options.db, + options.provider, + interactiveTransactions, + options.maxBoundParameters + ); }, // assume the database is sync with Drizzle schema async getSchemaVersion() { diff --git a/packages/core/fumadb/src/adapters/drizzle/query.ts b/packages/core/fumadb/src/adapters/drizzle/query.ts index eb502d5c7..9471ecda0 100644 --- a/packages/core/fumadb/src/adapters/drizzle/query.ts +++ b/packages/core/fumadb/src/adapters/drizzle/query.ts @@ -170,7 +170,8 @@ export function fromDrizzle( schema: AnySchema, _db: unknown, provider: SQLProvider, - interactiveTransactions: boolean = true + interactiveTransactions: boolean = true, + maxBoundParameters?: number ): AbstractQuery { const [db, drizzleTables] = parseDrizzle(_db); @@ -355,9 +356,18 @@ export function fromDrizzle( const idField = table.getIdColumn().names.drizzle; const drizzleTable = toDrizzle(table); values = values.map((v) => mapValues(v, table)); + // A multi-row insert binds (rows * columns) parameters in one statement. + // Some engines cap bound parameters per query (Cloudflare D1: 100), so + // size the batch by PARAMETER count, not row count — otherwise a wide + // table (e.g. tools) overflows with "too many SQL variables". Engines + // without a tight cap keep the row-count batch. + const columnsPerRow = values.length > 0 ? Math.max(1, Object.keys(values[0]!).length) : 1; + const batchSize = maxBoundParameters + ? Math.max(1, Math.min(CREATE_MANY_BATCH_SIZE, Math.floor(maxBoundParameters / columnsPerRow))) + : CREATE_MANY_BATCH_SIZE; const batches: (typeof values)[] = []; - for (let i = 0; i < values.length; i += CREATE_MANY_BATCH_SIZE) { - batches.push(values.slice(i, i + CREATE_MANY_BATCH_SIZE)); + for (let i = 0; i < values.length; i += batchSize) { + batches.push(values.slice(i, i + batchSize)); } if (provider === "sqlite" || provider === "postgresql") { @@ -399,13 +409,13 @@ export function fromDrizzle( // each statement auto-commits, so there is no atomic rollback (the // engine's constraint, not ours). libSQL/Postgres keep real transactions. if (!interactiveTransactions) { - return run(fromDrizzle(schema, _db, provider, interactiveTransactions)); + return run(fromDrizzle(schema, _db, provider, interactiveTransactions, maxBoundParameters)); } if (provider === "sqlite") { await executeRaw("BEGIN"); try { - const result = await run(fromDrizzle(schema, _db, provider, interactiveTransactions)); + const result = await run(fromDrizzle(schema, _db, provider, interactiveTransactions, maxBoundParameters)); await executeRaw("COMMIT"); return result; } catch (e) { @@ -415,7 +425,7 @@ export function fromDrizzle( } return db.transaction((tx) => - run(fromDrizzle(schema, tx, provider, interactiveTransactions)) + run(fromDrizzle(schema, tx, provider, interactiveTransactions, maxBoundParameters)) ); }, }); diff --git a/packages/core/sdk/src/executor-fuma-db.ts b/packages/core/sdk/src/executor-fuma-db.ts index 51267b73b..def0dd957 100644 --- a/packages/core/sdk/src/executor-fuma-db.ts +++ b/packages/core/sdk/src/executor-fuma-db.ts @@ -52,6 +52,12 @@ export interface CreateExecutorFumaDbOptions( db: drizzleDb, provider: options.provider, interactiveTransactions: options.interactiveTransactions, + maxBoundParameters: options.maxBoundParameters, }), ); From 13e7916bcc14eb373eeff9c4c5e126f09f8b2d41 Mon Sep 17 00:00:00 2001 From: Rhys Sullivan Date: Sun, 31 May 2026 02:39:49 -0700 Subject: [PATCH 05/31] Fix correctness bugs found by audit (Phase 0) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit - fumadb prisma adapter: recurse NOT conditions (`buildWhere(condition.item)`) instead of embedding the raw condition — `b.not(...)` produced invalid queries. - executor secretsStatus: skip connection-owned rows (as secretsList does) rather than short-circuiting to "missing"; a co-existing org-default value now resolves the secret. - host-cloudflare R2 offload: fail loud on a lost blob (was silently returning the pointer string, corrupting the read); add bounded retry with backoff around R2 put/get; simplify the D1 wrapper to a Proxy (removes the enumerated double-casts, delegates batch/exec/dump/withSession + internals). Verified: encrypted-secrets 7/7, sdk executor 17/17, fumadb 32, and the Vercel OpenAPI add (309 tools, R2 round-trip) still pass. --- .../host-cloudflare/src/db/r2-blob-offload.ts | Bin 9133 -> 10896 bytes .../core/fumadb/src/adapters/prisma/query.ts | 2 +- packages/core/sdk/src/executor.ts | 6 +++++- 3 files changed, 6 insertions(+), 2 deletions(-) diff --git a/apps/host-cloudflare/src/db/r2-blob-offload.ts b/apps/host-cloudflare/src/db/r2-blob-offload.ts index c4a113ab7b4d1d0b058ba77917ce4e4601d39271..45808c88c71ed11c565b64c66fc6b2fd1a8efc84 100644 GIT binary patch delta 2601 zcmcImU2oh(6czoDN>o85Ks2B#H=$DPc0Zc*0cn#IQKdztRH@QdJRs1H?dz-??~Iul zXR}J9<%KsMkd`Ne5U(I1f%ci-P<}$i58yX&W^5-7AEFY%FS{O(@7#OtIp_Mv_r831 zCmR+@Te9PVX@8DrV|hbZ5edUBe|JxFAv7oVt*|^~X{+TeHf8SrZ>`)Y;~mETpKpjW zlWv#PUY<$YPBJ5+oZFK3Y#S>~yvK2AmF`N_PE_e0#==-?w<%JkOoSfy=tHGQuzosRbfwgcA}kXk8XIliMWR?xZ`?ndQzLA^}8~)t0YnorD?7nARR# z4^+{kAf)x{bWf`Zpku7IXfzPEN5*PI3w!Qa{mAWfG|1Ufj^5nVTIn8@a!0C>T*VWI zdf*<{c+fgsT|K;6qicsZSFVIU7Ew)#$-lA!O#vm)+_utfJJ4!$oE%l#j$3X&j5@`-JY?LNWBg=EDtAAQd%W+Jo*4>8NWP%T?og;FxQFKb$ST^7zDg1cjTJ9zFQzV|oljOBe>t$#nD8#o3eB zo}4_59YoV_=NC@7f74&)=TEy?7fwHU^Yz*9^PitQ<9E1cPcK}WetqHA;lk|ch1D1S z`{;{Ro{PdThOpxd7_Oj7M{MAvz%zz6umyvY%s>>5G}YzwKU-M%1|zOZw;j)7F5q$! z?CBTP2=7yXAWq^i{(6`j=sMw?-CQEZVPiXRtmWL)j0_@Y$6YtNyGc1Lx=u&;*_aHp zzd}Ne$@ALJx{N1zV$d+va1}E#lL1I3*N5&A*W_O)fKrfI+fNg=Ce!RE@f=d bw8P`6jqa^L}5V*qM{;)MhIUiN=wH?P*GKY#DG*_LLIJsPZ|^ZUUPp4Q5t1n zUS5vQEPfzPx*?FB*vTs*fmGoERMz+)Z zvNrc~Zuc0qH^K?&*8sM+;XcHnQXxME;lIQ{!&sPzL5!4Je~5&#RfY(DB>X-oBL_6V z{7WK2u2F)d7MF#a9$J|SBjh@oKp>CY4k+Ok? zk*;+M2jJZ-IuVeljpXo}Mh3H=*G?);DaNV?&t4qC2^h|B5OQScPOF(-Zmee?um7ml zl%^VETczhVx7mS&N*Y_0;UjK4jvR4M> zqz85{_7)3?!wRG%GZQD4yujV7S3=`Z51*nvrQnvqe4xq=I(L)0=P9f(_AZtHGtylF z@=*Zxzzc*s616veBKL(D#Z->0Y+10Rx~(kZ{z)5`g@Qk{ixd2n{@+ki2D!@Ro!#bU P<$#OC<&V;@&HA<9&OjN8 diff --git a/packages/core/fumadb/src/adapters/prisma/query.ts b/packages/core/fumadb/src/adapters/prisma/query.ts index fccc469e4..a05539407 100644 --- a/packages/core/fumadb/src/adapters/prisma/query.ts +++ b/packages/core/fumadb/src/adapters/prisma/query.ts @@ -72,7 +72,7 @@ function buildWhere(condition: Condition): object { if (condition.type === ConditionType.Not) { return { - NOT: condition, + NOT: buildWhere(condition.item), }; } diff --git a/packages/core/sdk/src/executor.ts b/packages/core/sdk/src/executor.ts index d758e55b1..81102bd77 100644 --- a/packages/core/sdk/src/executor.ts +++ b/packages/core/sdk/src/executor.ts @@ -3975,8 +3975,12 @@ export const createExecutor = => Effect.gen(function* () { const rows = yield* secretRowsForId(id); - if (rows.some((row) => row.owned_by_connection_id)) return "missing"; + // Connection-owned rows are managed through their connection, not the + // picker — skip them (as `secretsList` does) rather than letting one + // poison the whole status. A co-existing org-default value still + // resolves the secret. for (const row of rows) { + if (row.owned_by_connection_id) continue; if (yield* secretRouteHasBackingValue(row)) return "resolved"; } From d61b5bfb53f42f091f72d8625421782d82d1728a Mon Sep 17 00:00:00 2001 From: Rhys Sullivan Date: Sun, 31 May 2026 02:43:49 -0700 Subject: [PATCH 06/31] =?UTF-8?q?Share=20the=20in-process=20MCP=20host=20w?= =?UTF-8?q?iring=20(dedup=20self-host=20=E2=86=94=20cloudflare)?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The per-session engine builder and the console error reporter were duplicated between apps/host-selfhost and apps/host-cloudflare. Extract both into @executor-js/api/server (where makeExecutionStack already lives): - makeMcpBuildServer(executionStackLayer): the makeExecutionStack → engine → createExecutorMcpServer chain; hosts pass only their fully-provided stack layer. - makeConsoleMcpErrorReporter(errorCapture): the McpErrorReporter-over-ErrorCapture seam; hosts pass only their capture layer. Both session-store.ts files collapse to a thin composition. The store body already lived in @executor-js/host-mcp/in-memory-session-store. Self-host MCP tests (8/8) still pass. --- apps/host-cloudflare/src/mcp/session-store.ts | 75 +++++------------- apps/host-selfhost/src/mcp/session-store.ts | 78 +++++-------------- packages/core/api/src/server.ts | 5 ++ packages/core/api/src/server/mcp-build.ts | 67 ++++++++++++++++ 4 files changed, 113 insertions(+), 112 deletions(-) create mode 100644 packages/core/api/src/server/mcp-build.ts diff --git a/apps/host-cloudflare/src/mcp/session-store.ts b/apps/host-cloudflare/src/mcp/session-store.ts index ab8c364ed..a1944d025 100644 --- a/apps/host-cloudflare/src/mcp/session-store.ts +++ b/apps/host-cloudflare/src/mcp/session-store.ts @@ -1,75 +1,42 @@ -import { Effect, Layer } from "effect"; -import type { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js"; +import { Layer } from "effect"; -import { ErrorCapture } from "@executor-js/api"; -import { type ExecutorDbHandle } from "@executor-js/api/server"; -import { McpErrorReporter, type Principal } from "@executor-js/host-mcp"; +import { + makeConsoleMcpErrorReporter, + makeMcpBuildServer, + type ExecutorDbHandle, +} from "@executor-js/api/server"; +import type { McpErrorReporter } from "@executor-js/host-mcp"; import { inMemoryMcpSessionsLayer, makeInMemoryMcpSessionStore, - McpEngineBuildError, type InMemoryMcpSessionStore, } from "@executor-js/host-mcp/in-memory-session-store"; -import { createExecutorMcpServer } from "@executor-js/host-mcp/tool-server"; import type { CloudflareConfig } from "../config"; -import { makeCloudflareExecutionStackLayer, makeExecutionStack } from "../execution"; +import { makeCloudflareExecutionStackLayer } from "../execution"; import { ErrorCaptureLive } from "../observability"; // --------------------------------------------------------------------------- -// Cloudflare McpSessionStore wiring — the shared in-process store -// (`@executor-js/host-mcp/in-memory-session-store`) over the QuickJS engine. -// -// Identical seam to self-host: the provider-neutral store body lives in -// host-mcp; the Cloudflare host supplies only the per-session `buildServer` (the -// QuickJS engine over the long-lived D1 handle) and the error reporter. The -// in-process store fits the single-Worker QuickJS model — one isolate owns the -// session. The cross-isolate variant is cloud's Durable Object store behind this -// same `McpSessionStore` seam; that's the v2 upgrade once sessions must survive -// isolate eviction (a DO bound to `env.MCP_SESSION`). +// Cloudflare McpSessionStore wiring — the SAME shared seam as self-host. The +// store body, the per-session engine builder (`makeMcpBuildServer`), and the +// console error reporter (`makeConsoleMcpErrorReporter`) all live in shared +// code; the Cloudflare host supplies only its fully-provided execution-stack +// layer (QuickJS over the long-lived D1 handle). The cross-isolate variant is +// cloud's Durable Object store behind this same `McpSessionStore` seam. // --------------------------------------------------------------------------- -/** - * Build the per-session `McpServer` for a principal: assemble the scoped QuickJS - * engine over the long-lived D1 handle (the shared `makeExecutionStack` reading - * the Cloudflare execution-stack seams) and hand it to `createExecutorMcpServer`. - */ -const makeBuildServer = - (config: CloudflareConfig, dbHandle: ExecutorDbHandle) => - (principal: Principal): Effect.Effect => - makeExecutionStack( - principal.accountId, - principal.organizationId, - principal.organizationName, - ).pipe( - Effect.map(({ engine }) => engine), - Effect.provide(makeCloudflareExecutionStackLayer(config, dbHandle)), - Effect.mapError((cause) => new McpEngineBuildError({ cause })), - Effect.flatMap((engine) => createExecutorMcpServer({ engine })), - ); - /** Build the in-process MCP session store over the long-lived D1 handle. */ export const makeCloudflareMcpSessionStore = ( config: CloudflareConfig, dbHandle: ExecutorDbHandle, -): InMemoryMcpSessionStore => makeInMemoryMcpSessionStore(makeBuildServer(config, dbHandle)); +): InMemoryMcpSessionStore => + makeInMemoryMcpSessionStore( + makeMcpBuildServer(makeCloudflareExecutionStackLayer(config, dbHandle)), + ); /** The `McpSessionStore` envelope seam over a freshly built in-process store. */ export const cloudflareMcpSessions = inMemoryMcpSessionsLayer; -// --------------------------------------------------------------------------- -// Cloudflare McpErrorReporter seam — routes an orchestration defect the MCP -// envelope is about to render as a JSON-RPC 500 through the host's console -// `ErrorCapture`, so the operator still sees it (the envelope otherwise swallows -// the cause into a Response). Mirrors self-host's reporter. -// --------------------------------------------------------------------------- - -export const cloudflareMcpReporter: Layer.Layer = Layer.effect( - McpErrorReporter, - Effect.gen(function* () { - const capture = yield* ErrorCapture; - return { - report: (cause) => Effect.asVoid(capture.captureException(cause)), - }; - }), -).pipe(Layer.provide(ErrorCaptureLive)); +/** Route 500-defects through the host's console `ErrorCapture`. */ +export const cloudflareMcpReporter: Layer.Layer = + makeConsoleMcpErrorReporter(ErrorCaptureLive); diff --git a/apps/host-selfhost/src/mcp/session-store.ts b/apps/host-selfhost/src/mcp/session-store.ts index 867bab86f..51d80d9cb 100644 --- a/apps/host-selfhost/src/mcp/session-store.ts +++ b/apps/host-selfhost/src/mcp/session-store.ts @@ -1,78 +1,40 @@ -import { Effect, Layer } from "effect"; -import type { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js"; +import { Layer } from "effect"; -import { ErrorCapture } from "@executor-js/api"; -import { McpErrorReporter, type Principal } from "@executor-js/host-mcp"; +import { makeConsoleMcpErrorReporter, makeMcpBuildServer } from "@executor-js/api/server"; +import type { McpErrorReporter } from "@executor-js/host-mcp"; import { inMemoryMcpSessionsLayer, makeInMemoryMcpSessionStore, - McpEngineBuildError, type InMemoryMcpSessionStore, } from "@executor-js/host-mcp/in-memory-session-store"; -import { createExecutorMcpServer } from "@executor-js/host-mcp/tool-server"; import { ErrorCaptureLive } from "../observability"; import { SelfHostDb, type SelfHostDbHandle } from "../db/self-host-db"; -import { makeExecutionStack, SelfHostExecutionStackLayer } from "../execution"; +import { SelfHostExecutionStackLayer } from "../execution"; // --------------------------------------------------------------------------- -// Self-host McpSessionStore wiring — the shared in-process store -// (`@executor-js/host-mcp/in-memory-session-store`) over self-host's engine. -// -// The store body (the transports/servers/owners Maps, dispatch, ownership, -// lifetime) is provider-neutral and lives in host-mcp; self-host supplies only -// the per-session `buildServer` (its QuickJS engine over the shared SelfHostDb) -// and the error-reporter override. Cloud's DO store and the Cloudflare host use -// the same `McpSessionStore` seam — different backends behind one envelope. +// Self-host McpSessionStore wiring. The store body (Maps, dispatch, ownership, +// lifetime), the per-session engine builder, and the console error reporter are +// ALL shared (`@executor-js/host-mcp/in-memory-session-store` + `makeMcpBuildServer` +// / `makeConsoleMcpErrorReporter` in `@executor-js/api/server`). Self-host +// supplies only its fully-provided execution-stack layer (QuickJS over the +// long-lived `SelfHostDb`) and its `ErrorCapture`. The Cloudflare host wires the +// identical seam with its own stack layer. // --------------------------------------------------------------------------- export { McpEngineBuildError } from "@executor-js/host-mcp/in-memory-session-store"; -/** - * The store's internal engine boundary: build the per-(user,org) scoped executor - * over the long-lived `SelfHostDb` (QuickJS code substrate) and hand the engine - * to `createExecutorMcpServer`. Engine construction reads the long-lived DB, so - * this closes over the handle captured at boot — no per-request layer plumbing. - */ -const makeBuildServer = - (db: SelfHostDbHandle) => - (principal: Principal): Effect.Effect => - makeExecutionStack( - principal.accountId, - principal.organizationId, - principal.organizationName, - ).pipe( - Effect.map(({ engine }) => engine), - Effect.provide(SelfHostExecutionStackLayer), - Effect.provideService(SelfHostDb, db), - Effect.mapError((cause) => new McpEngineBuildError({ cause })), - Effect.flatMap((engine) => createExecutorMcpServer({ engine })), - ); - -/** - * Build the in-process session store (plus its `close()` lifetime hook) over the - * long-lived `SelfHostDb` handle, using self-host's per-session engine builder. - */ +/** Build the in-process session store (plus its `close()` hook) over the DB handle. */ export const makeSelfHostMcpSessionStore = (db: SelfHostDbHandle): InMemoryMcpSessionStore => - makeInMemoryMcpSessionStore(makeBuildServer(db)); + makeInMemoryMcpSessionStore( + makeMcpBuildServer( + SelfHostExecutionStackLayer.pipe(Layer.provide(Layer.succeed(SelfHostDb)(db))), + ), + ); /** The `McpSessionStore` envelope seam over a freshly built in-process store. */ export const selfHostMcpSessions = inMemoryMcpSessionsLayer; -// --------------------------------------------------------------------------- -// Self-host McpErrorReporter seam — reuses the shared `ErrorCapture` service so -// a request-orchestration defect the shared MCP envelope is about to render as a -// JSON-RPC 500 still flows through the host's normal capture pipeline (self-host: -// the console `ErrorCaptureLive`). Without this seam override the envelope -// swallows the cause into a `Response` and the operator never sees it. -// --------------------------------------------------------------------------- - -export const selfHostMcpReporter: Layer.Layer = Layer.effect( - McpErrorReporter, - Effect.gen(function* () { - const capture = yield* ErrorCapture; - return { - report: (cause) => Effect.asVoid(capture.captureException(cause)), - }; - }), -).pipe(Layer.provide(ErrorCaptureLive)); +/** Route 500-defects through the host's console `ErrorCapture`. */ +export const selfHostMcpReporter: Layer.Layer = + makeConsoleMcpErrorReporter(ErrorCaptureLive); diff --git a/packages/core/api/src/server.ts b/packages/core/api/src/server.ts index b3cbb6ef3..24b22a76d 100644 --- a/packages/core/api/src/server.ts +++ b/packages/core/api/src/server.ts @@ -28,6 +28,11 @@ export { type EngineDecoratorShape, type EngineStackIdentity, } from "./server/execution-stack"; +export { + makeMcpBuildServer, + makeConsoleMcpErrorReporter, + type McpExecutionStackLayer, +} from "./server/mcp-build"; // Host-composition seams re-homed out of `@executor-js/sdk` (the plugin-author // contract) into this host surface. The pure FumaDB assembly (`createExecutorFumaDb` // + its types) keeps its definition in the SDK for the sqlite test backend and is diff --git a/packages/core/api/src/server/mcp-build.ts b/packages/core/api/src/server/mcp-build.ts new file mode 100644 index 000000000..216413102 --- /dev/null +++ b/packages/core/api/src/server/mcp-build.ts @@ -0,0 +1,67 @@ +import { Effect, Layer } from "effect"; + +import { McpErrorReporter, type Principal } from "@executor-js/host-mcp"; +import { + McpEngineBuildError, + type McpBuildServer, +} from "@executor-js/host-mcp/in-memory-session-store"; +import { createExecutorMcpServer } from "@executor-js/host-mcp/tool-server"; + +import { ErrorCapture } from "../observability"; +import { CodeExecutorProvider, EngineDecorator, makeExecutionStack } from "./execution-stack"; +import { DbProvider } from "./executor-fuma-db"; +import { HostConfig, PluginsProvider } from "./scoped-executor"; + +// --------------------------------------------------------------------------- +// Shared in-process MCP host helpers. +// +// Every host that serves MCP from one isolate (self-host, the Cloudflare QuickJS +// host) builds its per-session McpServer the same way — assemble the scoped +// engine via `makeExecutionStack`, wrap it with `createExecutorMcpServer` — and +// reports orchestration defects through the same console `ErrorCapture` seam. +// These two factories are the single home for that logic; a host supplies ONLY +// its fully-provided execution-stack layer and its `ErrorCapture` layer. The +// cross-isolate variant (cloud's Durable Object store) is the exception that +// builds its engine inside the DO. +// --------------------------------------------------------------------------- + +/** The five execution-stack seams a host fully provides (no residual). */ +export type McpExecutionStackLayer = Layer.Layer< + DbProvider | PluginsProvider | HostConfig | CodeExecutorProvider | EngineDecorator +>; + +/** + * Build the per-session MCP server factory over a host's execution stack: + * `makeExecutionStack` → engine → `createExecutorMcpServer`. Hosts differ only + * in the injected stack layer (libSQL vs D1, etc.). + */ +export const makeMcpBuildServer = + (executionStack: McpExecutionStackLayer): McpBuildServer => + (principal: Principal) => + makeExecutionStack( + principal.accountId, + principal.organizationId, + principal.organizationName, + ).pipe( + Effect.map(({ engine }) => engine), + Effect.provide(executionStack), + Effect.mapError((cause) => new McpEngineBuildError({ cause })), + Effect.flatMap((engine) => createExecutorMcpServer({ engine })), + ); + +/** + * The standard console `McpErrorReporter` seam: route an orchestration defect + * the MCP envelope would otherwise swallow into a 500 through the host's + * `ErrorCapture`, so operators still see it. Hosts differ only in the capture + * layer (self-host/Cloudflare console; cloud overrides with Sentry separately). + */ +export const makeConsoleMcpErrorReporter = ( + errorCapture: Layer.Layer, +): Layer.Layer => + Layer.effect( + McpErrorReporter, + Effect.gen(function* () { + const capture = yield* ErrorCapture; + return { report: (cause) => Effect.asVoid(capture.captureException(cause)) }; + }), + ).pipe(Layer.provide(errorCapture)); From 67963d23dfac4371921474de7636eb6e4adc8d9a Mon Sep 17 00:00:00 2001 From: Rhys Sullivan Date: Sun, 31 May 2026 02:49:30 -0700 Subject: [PATCH 07/31] host-cloudflare: add test harness + R2 offload round-trip tests First tests for the Cloudflare host (previously zero coverage). vitest config + deps, and r2-blob-offload.test.ts covering the D1->R2 large-value offload: oversized value -> short pointer + one R2 blob; small values stay inline; pointer rehydrates to the original on read; and a lost blob fails loud (locks in the missing-blob fix). Also makes the pointer sentinel an explicit NUL-byte prefix. --- apps/host-cloudflare/package.json | 8 +- .../src/db/r2-blob-offload.test.ts | 126 ++++++++++++++++++ .../host-cloudflare/src/db/r2-blob-offload.ts | Bin 10896 -> 10894 bytes apps/host-cloudflare/vitest.config.ts | 8 ++ bun.lock | 2 + 5 files changed, 142 insertions(+), 2 deletions(-) create mode 100644 apps/host-cloudflare/src/db/r2-blob-offload.test.ts create mode 100644 apps/host-cloudflare/vitest.config.ts diff --git a/apps/host-cloudflare/package.json b/apps/host-cloudflare/package.json index 2332e8436..67e158776 100644 --- a/apps/host-cloudflare/package.json +++ b/apps/host-cloudflare/package.json @@ -10,7 +10,9 @@ "typecheck": "tsgo --noEmit", "cf-typegen": "wrangler types", "deploy:setup": "bash scripts/deploy.sh", - "vendor-wasm": "bun run scripts/vendor-quickjs-wasm.ts" + "vendor-wasm": "bun run scripts/vendor-quickjs-wasm.ts", + "test": "vitest run", + "test:watch": "vitest" }, "dependencies": { "@effect/atom-react": "catalog:", @@ -47,6 +49,8 @@ "@vitejs/plugin-react": "catalog:", "typescript": "catalog:", "vite": "catalog:", - "wrangler": "^4.95.0" + "wrangler": "^4.95.0", + "@effect/vitest": "catalog:", + "vitest": "catalog:" } } diff --git a/apps/host-cloudflare/src/db/r2-blob-offload.test.ts b/apps/host-cloudflare/src/db/r2-blob-offload.test.ts new file mode 100644 index 000000000..fd4e55f09 --- /dev/null +++ b/apps/host-cloudflare/src/db/r2-blob-offload.test.ts @@ -0,0 +1,126 @@ +import { describe, expect, it } from "@effect/vitest"; +import type { D1Database, R2Bucket } from "@cloudflare/workers-types"; + +import { wrapD1WithR2Offload } from "./r2-blob-offload"; + +// --------------------------------------------------------------------------- +// Round-trip tests for the D1 -> R2 large-value offload. Minimal in-memory +// mocks for the D1 binding (captures the params actually bound; returns canned +// rows on read) and R2 (a Map). Exercises the public D1 surface the wrapper +// presents to drizzle: prepare -> bind -> run/all. +// --------------------------------------------------------------------------- + +const makeMemR2 = () => { + const store = new Map(); + const bucket = { + put: async (key: string, value: ArrayBuffer | ArrayBufferView | string) => { + const bytes = + typeof value === "string" + ? new TextEncoder().encode(value) + : value instanceof ArrayBuffer + ? new Uint8Array(value) + : new Uint8Array(value.buffer, value.byteOffset, value.byteLength); + store.set(key, bytes); + }, + get: async (key: string) => { + const bytes = store.get(key); + if (!bytes) return null; + return { + arrayBuffer: async () => + bytes.buffer.slice(bytes.byteOffset, bytes.byteOffset + bytes.byteLength), + text: async () => new TextDecoder().decode(bytes), + }; + }, + }; + // oxlint-disable-next-line executor/no-double-cast -- test mock: in-memory stand-in for the R2 binding + return { bucket: bucket as unknown as R2Bucket, store }; +}; + +// A fake D1 that records the params bound to the most recent statement and, on +// read, returns whatever rows the test stages. +const makeMockD1 = () => { + const state: { boundParams: unknown[]; rows: Record[] } = { + boundParams: [], + rows: [], + }; + const db = { + prepare: (_sql: string) => { + const stmt: Record = { + bind: (...params: unknown[]) => { + state.boundParams = params; + return stmt; + }, + run: async () => ({ success: true, meta: {}, results: state.rows }), + all: async () => ({ success: true, meta: {}, results: state.rows }), + first: async () => state.rows[0] ?? null, + raw: async () => state.rows.map((r) => Object.values(r)), + }; + return stmt; + }, + batch: async () => [], + exec: async () => ({ count: 0, duration: 0 }), + dump: async () => new ArrayBuffer(0), + }; + // oxlint-disable-next-line executor/no-double-cast -- test mock: in-memory stand-in for the D1 binding + return { db: db as unknown as D1Database, state }; +}; + +const big = "x".repeat(1_000_000); // > 800KB byte threshold + +describe("wrapD1WithR2Offload", () => { + it("offloads an oversized string param to R2 and binds a short pointer", async () => { + const r2 = makeMemR2(); + const mock = makeMockD1(); + const wrapped = wrapD1WithR2Offload(mock.db, r2.bucket); + + await wrapped.prepare("insert into t (a, b) values (?, ?)").bind("small", big).run(); + + expect(mock.state.boundParams[0]).toBe("small"); // small value untouched + const pointer = mock.state.boundParams[1]; + expect(typeof pointer).toBe("string"); + expect(pointer).not.toBe(big); + expect(String(pointer).length).toBeLessThan(200); // a short pointer, not 1MB + expect(r2.store.size).toBe(1); // exactly one blob written + }); + + it("leaves small params inline (no R2 write)", async () => { + const r2 = makeMemR2(); + const mock = makeMockD1(); + const wrapped = wrapD1WithR2Offload(mock.db, r2.bucket); + + await wrapped.prepare("insert into t (a) values (?)").bind("just small").run(); + + expect(mock.state.boundParams).toEqual(["just small"]); + expect(r2.store.size).toBe(0); + }); + + it("rehydrates a pointer back to the original value on read", async () => { + const r2 = makeMemR2(); + const mock = makeMockD1(); + const wrapped = wrapD1WithR2Offload(mock.db, r2.bucket); + + // Write to populate R2 + capture the pointer the column would store. + await wrapped.prepare("insert into t (b) values (?)").bind(big).run(); + const pointer = mock.state.boundParams[0]; + + // Now a read returns that pointer in the row; the wrapper must restore `big`. + mock.state.rows = [{ b: pointer }]; + const result = await wrapped.prepare("select b from t").all(); + + expect(result.results[0]!.b).toBe(big); + }); + + it("fails loud when an offloaded blob is missing (no silent corruption)", async () => { + const r2 = makeMemR2(); + const mock = makeMockD1(); + const wrapped = wrapD1WithR2Offload(mock.db, r2.bucket); + + // Write to mint a real pointer, then simulate R2 losing the object. + await wrapped.prepare("insert into t (b) values (?)").bind(big).run(); + const pointer = mock.state.boundParams[0]; + r2.store.clear(); + + mock.state.rows = [{ b: pointer }]; + await expect(wrapped.prepare("select b from t").all()).rejects.toThrow(/R2 blob lost/); + }); +}); diff --git a/apps/host-cloudflare/src/db/r2-blob-offload.ts b/apps/host-cloudflare/src/db/r2-blob-offload.ts index 45808c88c71ed11c565b64c66fc6b2fd1a8efc84..262e0bffd0098cde96661615b2f78804122d6457 100644 GIT binary patch delta 39 tcmbOb+84UvC970SsR0ng$EQ}LCYP4v7sVGD#V6(DC&ia-W@YPE0RSxc4uSvx delta 24 fcmeARoe;X=B`YJt Date: Sun, 31 May 2026 03:19:41 -0700 Subject: [PATCH 08/31] host-selfhost: lean Docker runtime + fail-fast startup MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Dockerfile: the runtime image shipped the entire build toolchain because it copied the full workspace node_modules. Reinstall production-only deps after the SPA build (--production --ignore-scripts; the root prepare hook is a dev tool) so the build/dev toolchain pulled by the full workspace install is dropped — vite, turbo, wrangler -> miniflare -> sharp/libvips (~800MB), astro, vitest. The built SPA in apps/host-selfhost/dist survives. Image 4.29GB -> 2.86GB; still boots healthy (health/SPA/MCP verified). serve.ts: wrap the entry-point startServer() so a pre-runtime failure (config / DB open, before Effect's runtime takes over) logs a diagnosable message and exits non-zero instead of an opaque unhandled rejection — readable container logs. --- apps/host-selfhost/Dockerfile | 7 +++++++ apps/host-selfhost/src/serve.ts | 12 +++++++++++- 2 files changed, 18 insertions(+), 1 deletion(-) diff --git a/apps/host-selfhost/Dockerfile b/apps/host-selfhost/Dockerfile index 435363a2d..2d24328bd 100644 --- a/apps/host-selfhost/Dockerfile +++ b/apps/host-selfhost/Dockerfile @@ -21,6 +21,13 @@ RUN bun install --frozen-lockfile # Builds @executor-js/vite-plugin (via turbo) then the self-host SPA into # apps/host-selfhost/dist. RUN cd apps/host-selfhost && bun run build +# Reinstall PRODUCTION deps only, so the runtime image excludes the build/dev +# toolchain pulled by the full workspace install — vite, turbo, wrangler → +# miniflare → sharp/libvips (~800MB), astro, vitest, etc. The built SPA lives in +# apps/host-selfhost/dist (outside node_modules), so it survives the reinstall. +# --ignore-scripts: the root `prepare` hook runs a dev-only tool +# (effect-language-service); runtime deps are prebuilt JS with no postinstall. +RUN rm -rf node_modules && bun install --frozen-lockfile --production --ignore-scripts # ── Runtime stage: serve the built app under Bun ──────────────────────────── FROM oven/bun:1 AS runtime diff --git a/apps/host-selfhost/src/serve.ts b/apps/host-selfhost/src/serve.ts index c48db6b01..64f54d55a 100644 --- a/apps/host-selfhost/src/serve.ts +++ b/apps/host-selfhost/src/serve.ts @@ -45,5 +45,15 @@ export const startServer = async (): Promise => { }; if (import.meta.main) { - await startServer(); + // oxlint-disable-next-line executor/no-try-catch-or-throw -- boundary: process entry point; turn a pre-runtime startup failure (config/DB open) into a diagnosable log + non-zero exit instead of an opaque unhandled rejection + try { + await startServer(); + } catch (error) { + // oxlint-disable-next-line executor/no-instanceof-error, executor/no-unknown-error-message -- boundary: format an arbitrary thrown startup error for the container log + console.error( + "[executor] failed to start:", + error instanceof Error ? (error.stack ?? error.message) : error, + ); + process.exit(1); + } } From a7f11030dfedfa7896d7db3c1fd546d432d69461 Mon Sep 17 00:00:00 2001 From: Rhys Sullivan Date: Sun, 31 May 2026 03:22:49 -0700 Subject: [PATCH 09/31] host-cloudflare: add full-stack e2e test (workerd/miniflare) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Boots the real worker via wrangler unstable_dev with a local D1 + R2 and dev-auth, then drives the HTTP surface: execute TypeScript (QuickJS-WASM on workerd), add an OpenAPI source + read it back (D1 write/read), the auth gate, and an MCP initialize handshake. First end-to-end coverage of the CF-specific stack together — locks in the D1 transaction/param-batch/R2-offload fixes and the QuickJS + MCP flows. 4/4 pass. --- .../src/worker.e2e.node.test.ts | 107 ++++++++++++++++++ 1 file changed, 107 insertions(+) create mode 100644 apps/host-cloudflare/src/worker.e2e.node.test.ts diff --git a/apps/host-cloudflare/src/worker.e2e.node.test.ts b/apps/host-cloudflare/src/worker.e2e.node.test.ts new file mode 100644 index 000000000..f443856ce --- /dev/null +++ b/apps/host-cloudflare/src/worker.e2e.node.test.ts @@ -0,0 +1,107 @@ +import { resolve } from "node:path"; +import { fileURLToPath } from "node:url"; + +import { afterAll, beforeAll, describe, expect, it } from "@effect/vitest"; +import { unstable_dev, type Unstable_DevWorker } from "wrangler"; + +// --------------------------------------------------------------------------- +// End-to-end test for the Cloudflare host: boots the REAL worker on workerd via +// Miniflare (wrangler `unstable_dev`) with a local D1 + R2, dev-auth on. This is +// the only test that exercises the CF-specific stack together — D1 schema +// bring-up, the R2 large-value offload, QuickJS-WASM execution, and the MCP +// envelope — through the actual HTTP surface. +// --------------------------------------------------------------------------- + +const dir = fileURLToPath(new URL(".", import.meta.url)); + +// Inline spec (no network); registers one tool, exercising the D1 write path. +const SPEC = JSON.stringify({ + openapi: "3.0.0", + info: { title: "Test", version: "1.0.0" }, + servers: [{ url: "https://example.com" }], + paths: { + "/ping": { get: { operationId: "ping", responses: { "200": { description: "ok" } } } }, + }, +}); + +describe("cloudflare host e2e (workerd/miniflare)", () => { + let worker: Unstable_DevWorker; + + beforeAll(async () => { + worker = await unstable_dev(resolve(dir, "worker.ts"), { + config: resolve(dir, "../wrangler.jsonc"), + ip: "127.0.0.1", + local: true, + experimental: { disableExperimentalWarning: true }, + vars: { + EXECUTOR_SECRET_KEY: "test-secret-key-0123456789abcdef", + ENABLE_DEV_AUTH: "true", + }, + }); + }, 120_000); + + afterAll(async () => { + await worker?.stop(); + }); + + it("executes TypeScript via /api/executions (QuickJS on workerd)", async () => { + const res = await worker.fetch("/api/executions", { + method: "POST", + headers: { "content-type": "application/json" }, + body: JSON.stringify({ code: "export default 6 * 7" }), + }); + expect(res.status).toBe(200); + const body = (await res.json()) as { text: string; isError: boolean }; + expect(body.isError).toBe(false); + expect(body.text).toBe("42"); + }, 60_000); + + it("adds an OpenAPI source and reads it back (D1 write + read path)", async () => { + const add = await worker.fetch("/api/scopes/default/openapi/specs", { + method: "POST", + headers: { "content-type": "application/json" }, + body: JSON.stringify({ + spec: { kind: "blob", value: SPEC }, + name: "Test API", + baseUrl: "https://example.com", + namespace: "testapi", + }), + }); + expect(add.status).toBe(200); + const added = (await add.json()) as { toolCount: number; namespace: string }; + expect(added.toolCount).toBeGreaterThan(0); + + const got = await worker.fetch("/api/scopes/default/openapi/sources/testapi"); + expect(got.status).toBe(200); + const source = (await got.json()) as { namespace: string } | null; + expect(source?.namespace).toBe("testapi"); + }, 60_000); + + it("gates the API when dev-auth is on but treats the request as the dev admin", async () => { + // dev-auth means the request is the fixed dev admin; /api/scope resolves. + const res = await worker.fetch("/api/scope"); + expect(res.status).toBe(200); + }); + + it("serves an MCP initialize handshake at /mcp", async () => { + const res = await worker.fetch("/mcp", { + method: "POST", + headers: { + "content-type": "application/json", + accept: "application/json, text/event-stream", + }, + body: JSON.stringify({ + jsonrpc: "2.0", + id: 1, + method: "initialize", + params: { + protocolVersion: "2025-03-26", + capabilities: {}, + clientInfo: { name: "test", version: "1" }, + }, + }), + }); + expect(res.status).toBe(200); + expect(res.headers.get("mcp-session-id")).toBeTruthy(); + }, 60_000); +}); From 537a2d64e3c8fc74bb04e936f66cd4ac81e2fe29 Mon Sep 17 00:00:00 2001 From: Rhys Sullivan Date: Sun, 31 May 2026 03:26:20 -0700 Subject: [PATCH 10/31] Restore repo-wide format + lint green - serve.ts: keep the startup error format on one line so the boundary oxlint-disable targets it after oxfmt's wrapping. - format the host-cloudflare package.json/README touched by tooling. --- apps/host-cloudflare/README.md | 16 ++++++++-------- apps/host-cloudflare/package.json | 6 +++--- apps/host-selfhost/src/serve.ts | 6 ++---- 3 files changed, 13 insertions(+), 15 deletions(-) diff --git a/apps/host-cloudflare/README.md b/apps/host-cloudflare/README.md index dbec3a4cc..1770dbbe8 100644 --- a/apps/host-cloudflare/README.md +++ b/apps/host-cloudflare/README.md @@ -4,14 +4,14 @@ Executor as a single Cloudflare Worker. The fourth app on the shared `ExecutorApp.make` facade (alongside cloud, self-host, and local) — same code paths, different injected providers: -| Seam | Cloudflare provider | -| --------------- | --------------------------------------------------------------- | -| **identity** | Cloudflare Access JWT (`Cf-Access-Jwt-Assertion`) — no app login | -| **db** | D1 (SQLite) via the shared FumaDB assembly | -| **engine** | QuickJS-WASM, in-Worker (no extra binding) | -| **mcp** | Access-JWT auth + the shared in-process session store | -| **account** | `/account/me` from the Access principal (members/keys → Access) | -| **web** | the shared multiplayer SPA (Workers Static Assets) | +| Seam | Cloudflare provider | +| ------------ | ---------------------------------------------------------------- | +| **identity** | Cloudflare Access JWT (`Cf-Access-Jwt-Assertion`) — no app login | +| **db** | D1 (SQLite) via the shared FumaDB assembly | +| **engine** | QuickJS-WASM, in-Worker (no extra binding) | +| **mcp** | Access-JWT auth + the shared in-process session store | +| **account** | `/account/me` from the Access principal (members/keys → Access) | +| **web** | the shared multiplayer SPA (Workers Static Assets) | Single-tenant: every Access-verified principal belongs to the one configured org. Members and credentials are managed in Cloudflare Access, not in-app. diff --git a/apps/host-cloudflare/package.json b/apps/host-cloudflare/package.json index 67e158776..4247dae9f 100644 --- a/apps/host-cloudflare/package.json +++ b/apps/host-cloudflare/package.json @@ -40,6 +40,7 @@ }, "devDependencies": { "@cloudflare/workers-types": "^4.20250410.0", + "@effect/vitest": "catalog:", "@executor-js/vite-plugin": "workspace:*", "@tailwindcss/vite": "catalog:", "@tanstack/router-plugin": "^1.167.12", @@ -49,8 +50,7 @@ "@vitejs/plugin-react": "catalog:", "typescript": "catalog:", "vite": "catalog:", - "wrangler": "^4.95.0", - "@effect/vitest": "catalog:", - "vitest": "catalog:" + "vitest": "catalog:", + "wrangler": "^4.95.0" } } diff --git a/apps/host-selfhost/src/serve.ts b/apps/host-selfhost/src/serve.ts index 64f54d55a..2d8b1d271 100644 --- a/apps/host-selfhost/src/serve.ts +++ b/apps/host-selfhost/src/serve.ts @@ -50,10 +50,8 @@ if (import.meta.main) { await startServer(); } catch (error) { // oxlint-disable-next-line executor/no-instanceof-error, executor/no-unknown-error-message -- boundary: format an arbitrary thrown startup error for the container log - console.error( - "[executor] failed to start:", - error instanceof Error ? (error.stack ?? error.message) : error, - ); + const detail = error instanceof Error ? (error.stack ?? error.message) : error; + console.error("[executor] failed to start:", detail); process.exit(1); } } From 9e52479bf919366d4b1fe3e2e07aa8684013b44f Mon Sep 17 00:00:00 2001 From: Rhys Sullivan Date: Sun, 31 May 2026 03:28:01 -0700 Subject: [PATCH 11/31] host-cloudflare e2e: add MCP tool-invocation (tools/call execute) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Extend the MCP test to the full flow — initialize → notifications/initialized → tools/call execute → assert the QuickJS result (42). Real tool invocation through the MCP envelope + session store on workerd, not just the handshake. --- .../src/worker.e2e.node.test.ts | 56 +++++++++++++------ 1 file changed, 38 insertions(+), 18 deletions(-) diff --git a/apps/host-cloudflare/src/worker.e2e.node.test.ts b/apps/host-cloudflare/src/worker.e2e.node.test.ts index f443856ce..0c89b7bf1 100644 --- a/apps/host-cloudflare/src/worker.e2e.node.test.ts +++ b/apps/host-cloudflare/src/worker.e2e.node.test.ts @@ -83,25 +83,45 @@ describe("cloudflare host e2e (workerd/miniflare)", () => { expect(res.status).toBe(200); }); - it("serves an MCP initialize handshake at /mcp", async () => { - const res = await worker.fetch("/mcp", { - method: "POST", - headers: { - "content-type": "application/json", - accept: "application/json, text/event-stream", - }, - body: JSON.stringify({ - jsonrpc: "2.0", - id: 1, - method: "initialize", - params: { - protocolVersion: "2025-03-26", - capabilities: {}, - clientInfo: { name: "test", version: "1" }, + it("invokes the execute tool over MCP (initialize → tools/call → QuickJS)", async () => { + const accept = "application/json, text/event-stream"; + const rpc = (sessionId: string | null, body: unknown) => + worker.fetch("/mcp", { + method: "POST", + headers: { + "content-type": "application/json", + accept, + ...(sessionId ? { "mcp-session-id": sessionId } : {}), }, - }), + body: JSON.stringify(body), + }); + + const init = await rpc(null, { + jsonrpc: "2.0", + id: 1, + method: "initialize", + params: { + protocolVersion: "2025-03-26", + capabilities: {}, + clientInfo: { name: "test", version: "1" }, + }, }); - expect(res.status).toBe(200); - expect(res.headers.get("mcp-session-id")).toBeTruthy(); + expect(init.status).toBe(200); + const sessionId = init.headers.get("mcp-session-id"); + expect(sessionId).toBeTruthy(); + + await rpc(sessionId, { jsonrpc: "2.0", method: "notifications/initialized" }); + + const call = await rpc(sessionId, { + jsonrpc: "2.0", + id: 2, + method: "tools/call", + params: { name: "execute", arguments: { code: "export default 6 * 7" } }, + }); + expect(call.status).toBe(200); + const result = (await call.json()) as { + result?: { structuredContent?: { result?: number } }; + }; + expect(result.result?.structuredContent?.result).toBe(42); }, 60_000); }); From f6d75207ab8681859c22bd34c34c6359d9075f09 Mon Sep 17 00:00:00 2001 From: Rhys Sullivan Date: Sun, 31 May 2026 03:36:36 -0700 Subject: [PATCH 12/31] host-cloudflare e2e: cover R2 offload + param-batching on real workerd MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Add a large synthetic OpenAPI spec (~1MB, 250 ops) to the e2e: the stored blob exceeds the ~800KB R2 offload threshold and the 250 derived tools exceed D1's 100 bound-parameter createMany limit. Asserts toolCount === 250 and reads the source back through R2 rehydration — the real-worker regression for all three D1 fixes (transactions, R2 offload, param batching). 5/5 pass. --- .../src/worker.e2e.node.test.ts | 45 +++++++++++++++++++ 1 file changed, 45 insertions(+) diff --git a/apps/host-cloudflare/src/worker.e2e.node.test.ts b/apps/host-cloudflare/src/worker.e2e.node.test.ts index 0c89b7bf1..10bf550ca 100644 --- a/apps/host-cloudflare/src/worker.e2e.node.test.ts +++ b/apps/host-cloudflare/src/worker.e2e.node.test.ts @@ -56,6 +56,51 @@ describe("cloudflare host e2e (workerd/miniflare)", () => { expect(body.text).toBe("42"); }, 60_000); + it("adds a LARGE OpenAPI source — exercises R2 offload (>800KB blob) + createMany batching (>100 tools)", async () => { + // Synthesize a spec big enough to (a) push the stored config blob past the + // ~800KB R2-offload threshold and (b) derive >100 tools (past D1's 100 + // bound-param createMany limit) — the real-worker regression for two of the + // three D1 fixes. + const paths: Record = {}; + for (let i = 0; i < 250; i++) { + paths[`/op${i}`] = { + get: { + operationId: `op${i}`, + summary: `operation ${i}`, + description: "d".repeat(4000), // padding -> ~1MB total spec + responses: { "200": { description: "ok" } }, + }, + }; + } + const largeSpec = JSON.stringify({ + openapi: "3.0.0", + info: { title: "Large", version: "1.0.0" }, + servers: [{ url: "https://example.com" }], + paths, + }); + expect(largeSpec.length).toBeGreaterThan(900_000); + + const add = await worker.fetch("/api/scopes/default/openapi/specs", { + method: "POST", + headers: { "content-type": "application/json" }, + body: JSON.stringify({ + spec: { kind: "blob", value: largeSpec }, + name: "Large API", + baseUrl: "https://example.com", + namespace: "largeapi", + }), + }); + expect(add.status).toBe(200); + const added = (await add.json()) as { toolCount: number }; + expect(added.toolCount).toBe(250); + + // Reads back through the R2 rehydration path (the >800KB blob lives in R2). + const got = await worker.fetch("/api/scopes/default/openapi/sources/largeapi"); + expect(got.status).toBe(200); + const source = (await got.json()) as { namespace: string } | null; + expect(source?.namespace).toBe("largeapi"); + }, 90_000); + it("adds an OpenAPI source and reads it back (D1 write + read path)", async () => { const add = await worker.fetch("/api/scopes/default/openapi/specs", { method: "POST", From cd694414b7d2a95319010e6a3a2a99bb3e12b7a6 Mon Sep 17 00:00:00 2001 From: Rhys Sullivan Date: Sun, 31 May 2026 10:34:58 -0700 Subject: [PATCH 13/31] host-cloudflare: give Access service tokens a stable identity MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Cloudflare Access service tokens (machine / API-key auth via the CF-Access-Client-Id/-Secret headers) carry `common_name` (the token's client id) instead of email/sub, so the verifier mapped them to an empty principal. Fall back to common_name for accountId/name. Extract the claim→Principal mapping into a pure, exported `principalFromAccessClaims` and unit-test it (human, admin, service-token, default-member). 4/4. --- .../src/auth/cloudflare-access.test.ts | 52 +++++++++++++++++++ .../src/auth/cloudflare-access.ts | 48 +++++++++++------ 2 files changed, 84 insertions(+), 16 deletions(-) create mode 100644 apps/host-cloudflare/src/auth/cloudflare-access.test.ts diff --git a/apps/host-cloudflare/src/auth/cloudflare-access.test.ts b/apps/host-cloudflare/src/auth/cloudflare-access.test.ts new file mode 100644 index 000000000..0fa0b97ce --- /dev/null +++ b/apps/host-cloudflare/src/auth/cloudflare-access.test.ts @@ -0,0 +1,52 @@ +import { describe, expect, it } from "@effect/vitest"; + +import type { CloudflareConfig } from "../config"; +import { principalFromAccessClaims } from "./cloudflare-access"; + +const config: CloudflareConfig = { + accessTeamDomain: "team.cloudflareaccess.com", + accessAud: "aud-tag", + accessNameClaim: "name", + accessGroupsClaim: "groups", + adminEmails: ["admin@example.com"], + organizationId: "default", + organizationName: "Default", + secretKey: "x".repeat(32), + allowLocalNetwork: false, + webBaseUrl: "https://localhost", + enableDevAuth: false, +}; + +describe("principalFromAccessClaims", () => { + it("maps a human identity (email + sub + groups)", () => { + const p = principalFromAccessClaims( + { sub: "user-123", email: "person@example.com", name: "Person", groups: ["eng"] }, + config, + ); + expect(p.accountId).toBe("user-123"); + expect(p.email).toBe("person@example.com"); + expect(p.name).toBe("Person"); + expect(p.roles).toEqual(["eng"]); + expect(p.organizationId).toBe("default"); + }); + + it("grants admin when the email is in the allowlist", () => { + const p = principalFromAccessClaims({ sub: "u", email: "ADMIN@example.com" }, config); + expect(p.roles).toContain("admin"); + }); + + it("gives a SERVICE TOKEN (common_name, no email/sub) a stable identity", () => { + // Cloudflare Access service-token JWT: common_name set, email/sub absent. + const p = principalFromAccessClaims({ common_name: "df8a20db.access", type: "app" }, config); + expect(p.accountId).toBe("df8a20db.access"); // not empty — stable per token + expect(p.name).toBe("df8a20db.access"); + expect(p.email).toBe(""); + expect(p.roles).toEqual(["member"]); // a token is a member, not an admin + expect(p.organizationId).toBe("default"); + }); + + it("defaults to member when there are no groups and no admin match", () => { + const p = principalFromAccessClaims({ sub: "u", email: "nobody@other.com" }, config); + expect(p.roles).toEqual(["member"]); + }); +}); diff --git a/apps/host-cloudflare/src/auth/cloudflare-access.ts b/apps/host-cloudflare/src/auth/cloudflare-access.ts index 24103ec57..84ecc7845 100644 --- a/apps/host-cloudflare/src/auth/cloudflare-access.ts +++ b/apps/host-cloudflare/src/auth/cloudflare-access.ts @@ -17,6 +17,37 @@ import type { CloudflareConfig } from "../config"; // Roles come from the admin allowlist + the Access groups claim. // --------------------------------------------------------------------------- +/** + * Map verified Access JWT claims onto the neutral `Principal`. Pure (no JWT + * verification) so it is unit-testable. Handles both human identities (email + + * sub, optional groups) and SERVICE TOKENS — machine/API-key auth via the + * `CF-Access-Client-Id`/`-Secret` headers — which carry `common_name` (the + * token's client id) instead of email/sub. Single-tenant: every principal + * belongs to the one configured org; admin comes from the email allowlist. + */ +export const principalFromAccessClaims = ( + claims: Record, + config: CloudflareConfig, +): Principal => { + const email = typeof claims.email === "string" ? claims.email : ""; + const sub = typeof claims.sub === "string" && claims.sub.length > 0 ? claims.sub : ""; + const commonName = typeof claims.common_name === "string" ? claims.common_name : ""; + const nameClaim = claims[config.accessNameClaim]; + const groupsClaim = claims[config.accessGroupsClaim]; + const groups = Array.isArray(groupsClaim) ? groupsClaim.map(String) : []; + const isAdmin = email.length > 0 && config.adminEmails.includes(email.toLowerCase()); + + return { + accountId: sub || email || commonName, + organizationId: config.organizationId, + organizationName: config.organizationName, + email, + name: typeof nameClaim === "string" ? nameClaim : commonName || null, + avatarUrl: null, + roles: isAdmin ? ["admin", ...groups] : groups.length > 0 ? groups : ["member"], + }; +}; + /** * Resolve a request to its verified `Principal`, or `null` when the Access * assertion is missing/invalid. The single source of truth for "who is this @@ -55,22 +86,7 @@ export const makeAccessVerifier = (config: CloudflareConfig) => { }).pipe(Effect.orElseSucceed(() => null)); if (!verified) return null; - const claims = verified.payload as Record; - const email = typeof claims.email === "string" ? claims.email : ""; - const nameClaim = claims[config.accessNameClaim]; - const groupsClaim = claims[config.accessGroupsClaim]; - const groups = Array.isArray(groupsClaim) ? groupsClaim.map(String) : []; - const isAdmin = email.length > 0 && config.adminEmails.includes(email.toLowerCase()); - - return { - accountId: typeof claims.sub === "string" && claims.sub.length > 0 ? claims.sub : email, - organizationId: config.organizationId, - organizationName: config.organizationName, - email, - name: typeof nameClaim === "string" ? nameClaim : null, - avatarUrl: null, - roles: isAdmin ? ["admin", ...groups] : groups.length > 0 ? groups : ["member"], - } satisfies Principal; + return principalFromAccessClaims(verified.payload as Record, config); }); return { verify }; From 8df6d3bd0a787e933705fe57e44540cccfa5ff71 Mon Sep 17 00:00:00 2001 From: Rhys Sullivan Date: Sun, 31 May 2026 11:36:00 -0700 Subject: [PATCH 14/31] Extract shared @executor-js/cloudflare package; move generic MCP primitives Cloud and host-cloudflare are both Cloudflare Workers; their DO-backed MCP machinery should be one shared package differing only by injected deps. Scaffold @executor-js/cloudflare (packages/hosts/cloudflare) and move the verbatim-generic primitives into it: worker-transport.ts (the agents/mcp worker transport) and do-headers.ts (W3C identity/trace header helpers). Cloud re-imports them; its worker-transport test (6/6) runs unchanged via the workers pool. host-mcp stays neutral (no Cloudflare Workers SDK on the self-host Bun install). --- apps/cloud/package.json | 1 + apps/cloud/src/mcp/session-durable-object.ts | 10 +++- apps/cloud/src/mcp/session-store.ts | 2 +- apps/cloud/src/mcp/worker-transport.test.ts | 5 +- bun.lock | 22 +++++++++ packages/hosts/cloudflare/CHANGELOG.md | 6 +++ packages/hosts/cloudflare/package.json | 48 +++++++++++++++++++ .../hosts/cloudflare}/src/mcp/do-headers.ts | 0 .../cloudflare}/src/mcp/worker-transport.ts | 0 packages/hosts/cloudflare/tsconfig.json | 26 ++++++++++ packages/hosts/cloudflare/vitest.config.ts | 8 ++++ 11 files changed, 124 insertions(+), 4 deletions(-) create mode 100644 packages/hosts/cloudflare/CHANGELOG.md create mode 100644 packages/hosts/cloudflare/package.json rename {apps/cloud => packages/hosts/cloudflare}/src/mcp/do-headers.ts (100%) rename {apps/cloud => packages/hosts/cloudflare}/src/mcp/worker-transport.ts (100%) create mode 100644 packages/hosts/cloudflare/tsconfig.json create mode 100644 packages/hosts/cloudflare/vitest.config.ts diff --git a/apps/cloud/package.json b/apps/cloud/package.json index fc0fa9200..76519a4e9 100644 --- a/apps/cloud/package.json +++ b/apps/cloud/package.json @@ -29,6 +29,7 @@ "@effect/atom-react": "catalog:", "@effect/opentelemetry": "catalog:", "@executor-js/api": "workspace:*", + "@executor-js/cloudflare": "workspace:*", "@executor-js/execution": "workspace:*", "@executor-js/host-mcp": "workspace:*", "@executor-js/plugin-graphql": "workspace:*", diff --git a/apps/cloud/src/mcp/session-durable-object.ts b/apps/cloud/src/mcp/session-durable-object.ts index 9ad45ff6a..64d633ef4 100644 --- a/apps/cloud/src/mcp/session-durable-object.ts +++ b/apps/cloud/src/mcp/session-durable-object.ts @@ -32,10 +32,16 @@ import { UserStoreService } from "../auth/context"; import { resolveOrganization } from "../auth/organization"; import { DbService, combinedSchema, resolveConnectionString } from "../db/db"; import { CloudExecutionStackLayer, makeExecutionStack } from "../engine/execution-stack"; -import { makeMcpWorkerTransport, type McpWorkerTransport } from "../mcp/worker-transport"; +import { + makeMcpWorkerTransport, + type McpWorkerTransport, +} from "@executor-js/cloudflare/mcp/worker-transport"; import { DoTelemetryLive } from "../observability/telemetry"; import { captureCause } from "../observability"; -import { INTERNAL_ACCOUNT_ID_HEADER, INTERNAL_ORGANIZATION_ID_HEADER } from "./do-headers"; +import { + INTERNAL_ACCOUNT_ID_HEADER, + INTERNAL_ORGANIZATION_ID_HEADER, +} from "@executor-js/cloudflare/mcp/do-headers"; // --------------------------------------------------------------------------- // Types diff --git a/apps/cloud/src/mcp/session-store.ts b/apps/cloud/src/mcp/session-store.ts index 4c4b6730e..665326ad2 100644 --- a/apps/cloud/src/mcp/session-store.ts +++ b/apps/cloud/src/mcp/session-store.ts @@ -48,7 +48,7 @@ import { withPropagationHeaders, withVerifiedIdentityHeaders, type VerifiedTokenHeaders, -} from "./do-headers"; +} from "@executor-js/cloudflare/mcp/do-headers"; /** * Forward a request to an existing session DO. `peek` tees the body for diff --git a/apps/cloud/src/mcp/worker-transport.test.ts b/apps/cloud/src/mcp/worker-transport.test.ts index b4405d2ea..95730d34c 100644 --- a/apps/cloud/src/mcp/worker-transport.test.ts +++ b/apps/cloud/src/mcp/worker-transport.test.ts @@ -1,6 +1,9 @@ import { describe, expect, it } from "@effect/vitest"; -import { JsonRpcRequestIdQueue, PREVIOUS_REQUEST_TIMEOUT_MS } from "./worker-transport"; +import { + JsonRpcRequestIdQueue, + PREVIOUS_REQUEST_TIMEOUT_MS, +} from "@executor-js/cloudflare/mcp/worker-transport"; const jsonRpcRequest = (body: unknown): Request => new Request("https://example.invalid/mcp", { diff --git a/bun.lock b/bun.lock index 3d89f2b78..0cf55f0e6 100644 --- a/bun.lock +++ b/bun.lock @@ -59,6 +59,7 @@ "@effect/atom-react": "catalog:", "@effect/opentelemetry": "catalog:", "@executor-js/api": "workspace:*", + "@executor-js/cloudflare": "workspace:*", "@executor-js/execution": "workspace:*", "@executor-js/host-mcp": "workspace:*", "@executor-js/plugin-graphql": "workspace:*", @@ -572,6 +573,25 @@ "vite": "catalog:", }, }, + "packages/hosts/cloudflare": { + "name": "@executor-js/cloudflare", + "version": "0.0.0", + "dependencies": { + "@executor-js/execution": "workspace:*", + "@executor-js/host-mcp": "workspace:*", + "@modelcontextprotocol/sdk": "^1.29.0", + "agents": "^0.10.0", + "effect": "catalog:", + }, + "devDependencies": { + "@cloudflare/workers-types": "^4.20250620.0", + "@effect/vitest": "catalog:", + "@types/node": "catalog:", + "bun-types": "catalog:", + "typescript": "catalog:", + "vitest": "catalog:", + }, + }, "packages/hosts/mcp": { "name": "@executor-js/host-mcp", "version": "1.4.4", @@ -1426,6 +1446,8 @@ "@executor-js/cloud": ["@executor-js/cloud@workspace:apps/cloud"], + "@executor-js/cloudflare": ["@executor-js/cloudflare@workspace:packages/hosts/cloudflare"], + "@executor-js/codemode-core": ["@executor-js/codemode-core@workspace:packages/kernel/core"], "@executor-js/config": ["@executor-js/config@workspace:packages/core/config"], diff --git a/packages/hosts/cloudflare/CHANGELOG.md b/packages/hosts/cloudflare/CHANGELOG.md new file mode 100644 index 000000000..f849bc011 --- /dev/null +++ b/packages/hosts/cloudflare/CHANGELOG.md @@ -0,0 +1,6 @@ +# @executor-js/cloudflare changelog + +This file exists for `changesets/action@v1` compatibility (it reads every +workspace package's `CHANGELOG.md` to build the Version Packages PR). +Canonical user-facing release notes are at `apps/cli/release-notes/next.md` +and on the GitHub Releases page. diff --git a/packages/hosts/cloudflare/package.json b/packages/hosts/cloudflare/package.json new file mode 100644 index 000000000..d788d1b36 --- /dev/null +++ b/packages/hosts/cloudflare/package.json @@ -0,0 +1,48 @@ +{ + "name": "@executor-js/cloudflare", + "version": "0.0.0", + "private": true, + "type": "module", + "exports": { + "./mcp/worker-transport": { + "types": "./src/mcp/worker-transport.ts", + "default": "./src/mcp/worker-transport.ts" + }, + "./mcp/do-headers": { + "types": "./src/mcp/do-headers.ts", + "default": "./src/mcp/do-headers.ts" + }, + "./mcp/response-peek": { + "types": "./src/mcp/response-peek.ts", + "default": "./src/mcp/response-peek.ts" + }, + "./mcp/session-store": { + "types": "./src/mcp/session-store.ts", + "default": "./src/mcp/session-store.ts" + }, + "./mcp/durable-object": { + "types": "./src/mcp/session-durable-object.ts", + "default": "./src/mcp/session-durable-object.ts" + } + }, + "scripts": { + "typecheck": "tsgo --noEmit", + "test": "vitest run", + "test:watch": "vitest" + }, + "dependencies": { + "@executor-js/execution": "workspace:*", + "@executor-js/host-mcp": "workspace:*", + "@modelcontextprotocol/sdk": "^1.29.0", + "agents": "^0.10.0", + "effect": "catalog:" + }, + "devDependencies": { + "@cloudflare/workers-types": "^4.20250620.0", + "@effect/vitest": "catalog:", + "@types/node": "catalog:", + "bun-types": "catalog:", + "typescript": "catalog:", + "vitest": "catalog:" + } +} diff --git a/apps/cloud/src/mcp/do-headers.ts b/packages/hosts/cloudflare/src/mcp/do-headers.ts similarity index 100% rename from apps/cloud/src/mcp/do-headers.ts rename to packages/hosts/cloudflare/src/mcp/do-headers.ts diff --git a/apps/cloud/src/mcp/worker-transport.ts b/packages/hosts/cloudflare/src/mcp/worker-transport.ts similarity index 100% rename from apps/cloud/src/mcp/worker-transport.ts rename to packages/hosts/cloudflare/src/mcp/worker-transport.ts diff --git a/packages/hosts/cloudflare/tsconfig.json b/packages/hosts/cloudflare/tsconfig.json new file mode 100644 index 000000000..ccb16ed0e --- /dev/null +++ b/packages/hosts/cloudflare/tsconfig.json @@ -0,0 +1,26 @@ +{ + "compilerOptions": { + "target": "ESNext", + "module": "ESNext", + "moduleResolution": "bundler", + "strict": true, + "esModuleInterop": true, + "skipLibCheck": true, + "noEmit": true, + "lib": ["ESNext", "DOM", "DOM.Iterable"], + "types": ["@cloudflare/workers-types", "node"], + "noUnusedLocals": true, + "noImplicitOverride": true, + "plugins": [ + { + "name": "@effect/language-service", + "ignoreEffectSuggestionsInTscExitCode": true, + "ignoreEffectWarningsInTscExitCode": true, + "diagnosticSeverity": { + "preferSchemaOverJson": "off" + } + } + ] + }, + "include": ["src/**/*.ts"] +} diff --git a/packages/hosts/cloudflare/vitest.config.ts b/packages/hosts/cloudflare/vitest.config.ts new file mode 100644 index 000000000..5bfa2d586 --- /dev/null +++ b/packages/hosts/cloudflare/vitest.config.ts @@ -0,0 +1,8 @@ +import { defineConfig } from "vitest/config"; + +export default defineConfig({ + test: { + include: ["src/**/*.test.ts"], + passWithNoTests: true, + }, +}); From c526029af3429864dab65cbb7e3e912adf9be6a3 Mon Sep 17 00:00:00 2001 From: Rhys Sullivan Date: Sun, 31 May 2026 11:40:45 -0700 Subject: [PATCH 15/31] Move response-peek into @executor-js/cloudflare with injected error seam The response peeker (telemetry span annotation + JSON-RPC body shape detection) is platform-generic; only its @sentry/cloudflare capture of -32603 internal errors was cloud-specific. Move it into the shared package and replace the hardcoded Sentry call with an injected onInternalError seam (cloud passes the Sentry capture; host-cloudflare will pass console/none). jsonRpcWebResponse was just host-mcp's jsonRpcErrorBody, so responses.ts stays in cloud. Cloud full suite green (57 workers + 105 node). --- apps/cloud/src/mcp/session-store.ts | 20 ++++++++-- .../cloudflare}/src/mcp/response-peek.ts | 39 ++++++++++++------- 2 files changed, 41 insertions(+), 18 deletions(-) rename {apps/cloud => packages/hosts/cloudflare}/src/mcp/response-peek.ts (88%) diff --git a/apps/cloud/src/mcp/session-store.ts b/apps/cloud/src/mcp/session-store.ts index 665326ad2..dbc6b67ce 100644 --- a/apps/cloud/src/mcp/session-store.ts +++ b/apps/cloud/src/mcp/session-store.ts @@ -31,8 +31,9 @@ // forward (any method, session-id present). // --------------------------------------------------------------------------- +import * as Sentry from "@sentry/cloudflare"; import { env } from "cloudflare:workers"; -import { Effect, Layer } from "effect"; +import { Data, Effect, Layer } from "effect"; import { McpSessionStore, @@ -40,7 +41,16 @@ import { type McpDispatchResult, } from "@executor-js/host-mcp"; -import { peekAndAnnotate } from "./response-peek"; +import { peekAndAnnotate } from "@executor-js/cloudflare/mcp/response-peek"; + +// Cloud's Sentry capture for a JSON-RPC internal (-32603) error the response +// peeker surfaces — injected into the shared `peekAndAnnotate`. +class McpInternalJsonRpcError extends Data.TaggedError("McpInternalJsonRpcError")<{ + readonly message: string; +}> {} +const reportInternalErrorToSentry = (message: string): void => { + Sentry.captureException(new McpInternalJsonRpcError({ message })); +}; import { currentPropagationHeaders, readElicitationMode, @@ -79,7 +89,9 @@ const forwardToExistingSession = ( }, }), ); - const annotated = peek ? yield* peekAndAnnotate(raw) : raw; + const annotated = peek + ? yield* peekAndAnnotate(raw, { onInternalError: reportInternalErrorToSentry }) + : raw; return withMcpResponseHeaders(annotated); }); @@ -117,7 +129,7 @@ const createSession = (request: Request, token: VerifiedTokenHeaders): Effect.Ef }, }), ); - const annotated = yield* peekAndAnnotate(raw); + const annotated = yield* peekAndAnnotate(raw, { onInternalError: reportInternalErrorToSentry }); return withMcpResponseHeaders(annotated); }); diff --git a/apps/cloud/src/mcp/response-peek.ts b/packages/hosts/cloudflare/src/mcp/response-peek.ts similarity index 88% rename from apps/cloud/src/mcp/response-peek.ts rename to packages/hosts/cloudflare/src/mcp/response-peek.ts index ad7a78ca2..cb0403beb 100644 --- a/apps/cloud/src/mcp/response-peek.ts +++ b/packages/hosts/cloudflare/src/mcp/response-peek.ts @@ -1,9 +1,12 @@ -import * as Sentry from "@sentry/cloudflare"; import { Cause, Data, Effect, Exit, Option, Schema } from "effect"; -import { jsonRpcWebResponse } from "./responses"; +import { jsonRpcErrorBody } from "@executor-js/host-mcp"; -const SSE_PEEK_TIMEOUT_MS = 10_000; +const DEFAULT_SSE_PEEK_TIMEOUT_MS = 10_000; + +/** Observe a JSON-RPC internal error (-32603) seen on a peeked response. The + * host injects this (cloud: Sentry capture; host-cloudflare: console / omit). */ +export type OnInternalJsonRpcError = (message: string) => void; class ResponseBodyTimeoutError extends Data.TaggedError("ResponseBodyTimeoutError")<{ readonly timeoutMs: number; @@ -11,10 +14,6 @@ class ResponseBodyTimeoutError extends Data.TaggedError("ResponseBodyTimeoutErro class ResponseBodyReadError extends Data.TaggedError("ResponseBodyReadError") {} -class McpInternalJsonRpcError extends Data.TaggedError("McpInternalJsonRpcError")<{ - readonly message: string; -}> {} - const ResponseBodyTimeoutErrorData = Schema.Struct({ _tag: Schema.Literal("ResponseBodyTimeoutError"), timeoutMs: Schema.Number, @@ -179,7 +178,7 @@ const responseReadFailure = (error: unknown) => "mcp.peek_response.timed_out": timedOut, "mcp.peek_response.error": timedOut ? "ResponseBodyTimeoutError" : "ResponseBodyReadError", }); - return jsonRpcWebResponse( + return jsonRpcErrorBody( timedOut ? 504 : 500, -32001, timedOut @@ -188,14 +187,26 @@ const responseReadFailure = (error: unknown) => ); }); -const reportInternalJsonRpcError = (payload: JsonRpcResponseBody | null) => +const reportInternalJsonRpcError = ( + payload: JsonRpcResponseBody | null, + onInternalError: OnInternalJsonRpcError | undefined, +) => Effect.sync(() => { if (payload?.error?.code !== -32603) return; - const message = payload.error["message"] ?? "unknown"; - Sentry.captureException(new McpInternalJsonRpcError({ message })); + onInternalError?.(payload.error["message"] ?? "unknown"); }); -export const peekAndAnnotate = (response: Response): Effect.Effect => +export interface PeekAndAnnotateOptions { + /** Observe a JSON-RPC -32603 internal error (cloud injects Sentry capture). */ + readonly onInternalError?: OnInternalJsonRpcError; + /** SSE body read timeout (defaults to 10s). */ + readonly sseTimeoutMs?: number; +} + +export const peekAndAnnotate = ( + response: Response, + options: PeekAndAnnotateOptions = {}, +): Effect.Effect => Effect.gen(function* () { const contentType = response.headers.get("content-type") ?? ""; if (response.status === 202) { @@ -208,7 +219,7 @@ export const peekAndAnnotate = (response: Response): Effect.Effect => } const isSseResponse = contentType.includes("text/event-stream"); - const timeoutMs = isSseResponse ? SSE_PEEK_TIMEOUT_MS : null; + const timeoutMs = isSseResponse ? (options.sseTimeoutMs ?? DEFAULT_SSE_PEEK_TIMEOUT_MS) : null; const textExit = yield* Effect.exit( Effect.tryPromise({ try: () => readResponseText(response, timeoutMs), @@ -242,7 +253,7 @@ export const peekAndAnnotate = (response: Response): Effect.Effect => }); const attrs = jsonRpcResponseAttrs(payload); if (Object.keys(attrs).length > 0) yield* Effect.annotateCurrentSpan(attrs); - yield* reportInternalJsonRpcError(payload); + yield* reportInternalJsonRpcError(payload, options.onInternalError); return new Response(text, { status: response.status, From 1a932e4dbcbd630120369c84a2332f9c84e5119e Mon Sep 17 00:00:00 2001 From: Rhys Sullivan Date: Sun, 31 May 2026 11:45:16 -0700 Subject: [PATCH 16/31] Extract the DO-dispatcher McpSessionStore into the shared package MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit makeDurableObjectMcpSessionStore({getStub,newStub,onInternalError?}) owns the generic worker→DO orchestration (create via newStub, forward via getStub by session-id==DO-id, dispose; identity-header stamping, W3C trace propagation, response peek, verbatim DO error passthrough). Cloud's cloudMcpSessionStoreLayer collapses to a thin wrapper passing env.MCP_SESSION accessors + the Sentry reporter. Cloud full suite green (57 workers + 105 node) — the 403 -32003 / 404 -32001 error bytes preserved. --- apps/cloud/src/mcp/session-store.ts | 183 ++---------------- .../hosts/cloudflare/src/mcp/do-headers.ts | 4 +- packages/hosts/cloudflare/src/mcp/seams.ts | 25 +++ .../hosts/cloudflare/src/mcp/session-store.ts | 169 ++++++++++++++++ 4 files changed, 213 insertions(+), 168 deletions(-) create mode 100644 packages/hosts/cloudflare/src/mcp/seams.ts create mode 100644 packages/hosts/cloudflare/src/mcp/session-store.ts diff --git a/apps/cloud/src/mcp/session-store.ts b/apps/cloud/src/mcp/session-store.ts index dbc6b67ce..53ddfd2d0 100644 --- a/apps/cloud/src/mcp/session-store.ts +++ b/apps/cloud/src/mcp/session-store.ts @@ -1,180 +1,31 @@ // --------------------------------------------------------------------------- -// Cloud McpSessionStore adapter — the Durable-Object-backed variant of the -// shared host-mcp session seam (cloud's analog of the self-host in-process -// store). -// -// `dispatch` owns the OUTER worker-isolate orchestration (the helpers it uses -// live in ./do-headers + ./response-peek): -// - choose the DO stub (newUniqueId for create vs idFromString for forward) -// - stub.init(...) on create, stub.handleRequest(...) on forward/create -// - identity-header injection (withVerifiedIdentityHeaders) + trace -// propagation (withPropagationHeaders + currentPropagationHeaders) -// - response post-processing (peekAndAnnotate, withMcpResponseHeaders) -// - elicitation-mode parsing (readElicitationMode) -// -// The DO CLASS internals (engine build + MCP server + transport inside the -// isolate, owner validation against stored meta, restore/suspend, alarm) stay -// UNCHANGED — the store is the DO's cross-isolate engine host. -// -// IMPORTANT: the store returns the DO `Response` VERBATIM for the two cloud -// error shapes so their exact bytes are preserved: -// - owner mismatch -> 403 -32003 "MCP session does not belong to the current bearer" -// - timed out -> 404 -32001 "Session timed out due to inactivity — please reconnect" -// Returning the DO Response (not the seam's "forbidden"/"not-found" -// discriminants) keeps the "does not belong" / "timed out" message assertions -// byte-for-byte. (The envelope's "forbidden" discriminant happens to render the -// identical 403 -32003 body, but "not-found" would emit a generic "Session not -// found" message, so for that path the DO Response is mandatory.) -// -// The envelope short-circuits a bare GET (400) and bare DELETE (204) BEFORE -// calling dispatch, so the store only ever sees create (POST, no session-id) or -// forward (any method, session-id present). +// Cloud McpSessionStore — the shared Durable-Object dispatcher +// (@executor-js/cloudflare) over cloud's `env.MCP_SESSION` namespace. Cloud +// supplies only the stub accessors + the Sentry capture for internal errors; +// all dispatch/identity/trace/peek logic is in the shared package, identical to +// host-cloudflare. // --------------------------------------------------------------------------- import * as Sentry from "@sentry/cloudflare"; import { env } from "cloudflare:workers"; -import { Data, Effect, Layer } from "effect"; +import { Data } from "effect"; import { - McpSessionStore, - type McpDispatchInput, - type McpDispatchResult, -} from "@executor-js/host-mcp"; - -import { peekAndAnnotate } from "@executor-js/cloudflare/mcp/response-peek"; + makeDurableObjectMcpSessionStore, + type McpSessionDOStub, +} from "@executor-js/cloudflare/mcp/session-store"; // Cloud's Sentry capture for a JSON-RPC internal (-32603) error the response -// peeker surfaces — injected into the shared `peekAndAnnotate`. +// peeker surfaces — injected into the shared store. class McpInternalJsonRpcError extends Data.TaggedError("McpInternalJsonRpcError")<{ readonly message: string; }> {} -const reportInternalErrorToSentry = (message: string): void => { - Sentry.captureException(new McpInternalJsonRpcError({ message })); -}; -import { - currentPropagationHeaders, - readElicitationMode, - withMcpResponseHeaders, - withPropagationHeaders, - withVerifiedIdentityHeaders, - type VerifiedTokenHeaders, -} from "@executor-js/cloudflare/mcp/do-headers"; - -/** - * Forward a request to an existing session DO. `peek` tees the body for - * telemetry on POST/DELETE; GET (SSE) streams through untouched. Returns the - * DO `Response` verbatim (incl. its 403 -32003 / 404 -32001 error bodies). - */ -const forwardToExistingSession = ( - request: Request, - sessionId: string, - peek: boolean, - token: VerifiedTokenHeaders, -): Effect.Effect => - Effect.gen(function* () { - const ns = env.MCP_SESSION; - const stub = ns.get(ns.idFromString(sessionId)); - const propagation = yield* currentPropagationHeaders(request); - const propagated = withPropagationHeaders( - withVerifiedIdentityHeaders(request, token), - propagation, - ); - const raw = yield* Effect.promise( - () => stub.handleRequest(propagated) as Promise, - ).pipe( - Effect.withSpan("mcp.do.handle_request", { - attributes: { - "mcp.request.method": request.method, - "mcp.request.session_id_present": true, - }, - }), - ); - const annotated = peek - ? yield* peekAndAnnotate(raw, { onInternalError: reportInternalErrorToSentry }) - : raw; - return withMcpResponseHeaders(annotated); - }); - -/** Open a new session DO (POST, no session-id): init then handleRequest. */ -const createSession = (request: Request, token: VerifiedTokenHeaders): Effect.Effect => - Effect.gen(function* () { - const ns = env.MCP_SESSION; - const stub = ns.get(ns.newUniqueId()); - const propagation = yield* currentPropagationHeaders(request); - yield* Effect.promise(() => - stub.init( - { - organizationId: token.organizationId, - userId: token.accountId, - elicitationMode: readElicitationMode(request), - }, - propagation, - ), - ).pipe( - Effect.withSpan("mcp.do.init", { - attributes: { "mcp.request.session_id_present": false }, - }), - ); - const propagated = withPropagationHeaders( - withVerifiedIdentityHeaders(request, token), - propagation, - ); - const raw = yield* Effect.promise( - () => stub.handleRequest(propagated) as Promise, - ).pipe( - Effect.withSpan("mcp.do.handle_request", { - attributes: { - "mcp.request.method": request.method, - "mcp.request.session_id_present": false, - }, - }), - ); - const annotated = yield* peekAndAnnotate(raw, { onInternalError: reportInternalErrorToSentry }); - return withMcpResponseHeaders(annotated); - }); - -const clearExistingSession = (sessionId: string, request?: Request): Effect.Effect => - Effect.gen(function* () { - const ns = env.MCP_SESSION; - const stub = ns.get(ns.idFromString(sessionId)); - // Disposal carries trace context from the active request span. When the - // envelope forwards the inbound request (the Forbidden-with-session - // teardown), use it so the request's W3C tracestate/baggage propagate onto - // the clearSession RPC (the OLD clearExistingSession(request, sessionId) - // behavior); otherwise fall back to a synthetic request (traceparent still - // links the span via the active Effect span). - const propagation = yield* currentPropagationHeaders( - request ?? new Request("https://mcp.invalid/mcp"), - ); - yield* Effect.promise(() => stub.clearSession(propagation) as Promise).pipe( - Effect.catchCause(() => Effect.void), - Effect.withSpan("mcp.do.clear_session", { - attributes: { "mcp.request.session_id_present": true }, - }), - ); - }); -export const cloudMcpSessionStoreLayer: Layer.Layer = Layer.succeed( - McpSessionStore, -)({ - dispatch: ({ - request, - principal, - sessionId, - }: McpDispatchInput): Effect.Effect => { - // The principal carries the verified account + org used to stamp the DO's - // identity headers (the DO validates ownership against stored meta). - const token: VerifiedTokenHeaders = { - accountId: principal.accountId, - organizationId: principal.organizationId, - }; - // The enclosing `mcp.request` span is opened once per request by the cloud - // McpAuthProvider's `authenticate` (auth-provider.ts), which also carries - // the client-fingerprint attributes. The DO RPC child spans (`mcp.do.*`) - // attach to it directly, so dispatch must NOT open a second `mcp.request`. - return sessionId - ? forwardToExistingSession(request, sessionId, request.method !== "GET", token) - : createSession(request, token); - }, - dispose: (sessionId, request) => clearExistingSession(sessionId, request), +export const cloudMcpSessionStoreLayer = makeDurableObjectMcpSessionStore({ + // oxlint-disable-next-line executor/no-double-cast -- boundary: the DO RPC stub structurally satisfies McpSessionDOStub + getStub: (sessionId) => + env.MCP_SESSION.get(env.MCP_SESSION.idFromString(sessionId)) as unknown as McpSessionDOStub, + // oxlint-disable-next-line executor/no-double-cast -- boundary: the DO RPC stub structurally satisfies McpSessionDOStub + newStub: () => env.MCP_SESSION.get(env.MCP_SESSION.newUniqueId()) as unknown as McpSessionDOStub, + onInternalError: (message) => Sentry.captureException(new McpInternalJsonRpcError({ message })), }); diff --git a/packages/hosts/cloudflare/src/mcp/do-headers.ts b/packages/hosts/cloudflare/src/mcp/do-headers.ts index 5e051829c..18499dad1 100644 --- a/packages/hosts/cloudflare/src/mcp/do-headers.ts +++ b/packages/hosts/cloudflare/src/mcp/do-headers.ts @@ -31,7 +31,7 @@ export type VerifiedTokenHeaders = { // context across with W3C headers: `traceparent` generated from the active // Effect span plus passthrough `tracestate` / `baggage` from the inbound // request. -type IncomingPropagationHeaders = { +export type IncomingPropagationHeaders = { readonly traceparent?: string; readonly tracestate?: string; readonly baggage?: string; @@ -90,7 +90,7 @@ export const withMcpResponseHeaders = (response: Response): Response => { }); }; -type McpElicitationMode = "browser" | "model" | "native"; +export type McpElicitationMode = "browser" | "model" | "native"; const MCP_ELICITATION_MODES = new Set(["browser", "model", "native"]); diff --git a/packages/hosts/cloudflare/src/mcp/seams.ts b/packages/hosts/cloudflare/src/mcp/seams.ts new file mode 100644 index 000000000..aec5391d3 --- /dev/null +++ b/packages/hosts/cloudflare/src/mcp/seams.ts @@ -0,0 +1,25 @@ +import type { IncomingPropagationHeaders, McpElicitationMode } from "./do-headers"; + +// --------------------------------------------------------------------------- +// The injection seams shared between the worker-side DO dispatcher and the +// DO-side base class. A host (cloud / host-cloudflare) supplies its own DO +// namespace + runtime builder; everything else is platform-generic. +// --------------------------------------------------------------------------- + +/** What the worker tells the session DO at creation (owner + elicitation mode). */ +export interface McpSessionInit { + readonly organizationId: string; + readonly userId: string; + readonly elicitationMode: McpElicitationMode; +} + +/** + * The RPC surface the worker calls on a session-DO stub. The DO base class + * (McpSessionDOBase) implements these; a host's concrete DO subclass inherits + * them. The worker dispatcher only depends on this interface, not the class. + */ +export interface McpSessionDOStub { + init(meta: McpSessionInit, propagation: IncomingPropagationHeaders): Promise; + handleRequest(request: Request): Promise; + clearSession(propagation: IncomingPropagationHeaders): Promise; +} diff --git a/packages/hosts/cloudflare/src/mcp/session-store.ts b/packages/hosts/cloudflare/src/mcp/session-store.ts new file mode 100644 index 000000000..1ec69723a --- /dev/null +++ b/packages/hosts/cloudflare/src/mcp/session-store.ts @@ -0,0 +1,169 @@ +// --------------------------------------------------------------------------- +// The Durable-Object-backed McpSessionStore — the cross-isolate variant of the +// shared host-mcp session seam. Shared by every Cloudflare host (cloud + +// host-cloudflare); a host supplies ONLY its DO namespace accessors (newStub +// for create, getStub for forward, addressed by the session-id == DO-id) and an +// optional internal-error reporter. Everything else — identity-header stamping, +// W3C trace propagation, response peeking, the verbatim DO error passthrough — +// is platform-generic. +// +// `dispatch` owns the worker-isolate orchestration: +// - sessionId null + POST initialize -> newStub() -> init(meta) + handleRequest +// - sessionId present -> getStub(id) -> handleRequest (the DO id routes back to +// the same isolate, which is the whole point — sessions survive across the +// worker's stateless isolates). +// +// IMPORTANT: the DO `Response` is returned VERBATIM (incl. its 403 -32003 / +// 404 -32001 error bodies) — the envelope's "forbidden"/"not-found" discriminants +// would emit different message bytes. The envelope short-circuits bare GET (400) +// and DELETE (204) before dispatch, so dispatch only sees create or forward. +// --------------------------------------------------------------------------- + +import { Effect, Layer } from "effect"; + +import { + McpSessionStore, + type McpDispatchInput, + type McpDispatchResult, +} from "@executor-js/host-mcp"; + +import { + currentPropagationHeaders, + readElicitationMode, + withMcpResponseHeaders, + withPropagationHeaders, + withVerifiedIdentityHeaders, + type VerifiedTokenHeaders, +} from "./do-headers"; +import { peekAndAnnotate, type OnInternalJsonRpcError } from "./response-peek"; +import type { McpSessionDOStub } from "./seams"; + +export type { McpSessionDOStub, McpSessionInit } from "./seams"; + +export interface DurableObjectStoreConfig { + /** Resolve the stub for an existing session id (the id IS the DO id). */ + readonly getStub: (sessionId: string) => McpSessionDOStub; + /** Mint a fresh session DO stub (a new unique id) for a create. */ + readonly newStub: () => McpSessionDOStub; + /** Observe a JSON-RPC -32603 the peeker surfaces (cloud: Sentry). */ + readonly onInternalError?: OnInternalJsonRpcError; +} + +/** + * Forward a request to an existing session DO. `peek` tees the body for + * telemetry on POST/DELETE; GET (SSE) streams through untouched. Returns the DO + * `Response` verbatim (incl. its 403 -32003 / 404 -32001 error bodies). + */ +const forwardToExistingSession = ( + config: DurableObjectStoreConfig, + request: Request, + sessionId: string, + peek: boolean, + token: VerifiedTokenHeaders, +): Effect.Effect => + Effect.gen(function* () { + const stub = config.getStub(sessionId); + const propagation = yield* currentPropagationHeaders(request); + const propagated = withPropagationHeaders( + withVerifiedIdentityHeaders(request, token), + propagation, + ); + const raw = yield* Effect.promise(() => stub.handleRequest(propagated)).pipe( + Effect.withSpan("mcp.do.handle_request", { + attributes: { + "mcp.request.method": request.method, + "mcp.request.session_id_present": true, + }, + }), + ); + const annotated = peek + ? yield* peekAndAnnotate(raw, { onInternalError: config.onInternalError }) + : raw; + return withMcpResponseHeaders(annotated); + }); + +/** Open a new session DO (POST, no session-id): init then handleRequest. */ +const createSession = ( + config: DurableObjectStoreConfig, + request: Request, + token: VerifiedTokenHeaders, +): Effect.Effect => + Effect.gen(function* () { + const stub = config.newStub(); + const propagation = yield* currentPropagationHeaders(request); + yield* Effect.promise(() => + stub.init( + { + organizationId: token.organizationId, + userId: token.accountId, + elicitationMode: readElicitationMode(request), + }, + propagation, + ), + ).pipe( + Effect.withSpan("mcp.do.init", { + attributes: { "mcp.request.session_id_present": false }, + }), + ); + const propagated = withPropagationHeaders( + withVerifiedIdentityHeaders(request, token), + propagation, + ); + const raw = yield* Effect.promise(() => stub.handleRequest(propagated)).pipe( + Effect.withSpan("mcp.do.handle_request", { + attributes: { + "mcp.request.method": request.method, + "mcp.request.session_id_present": false, + }, + }), + ); + const annotated = yield* peekAndAnnotate(raw, { onInternalError: config.onInternalError }); + return withMcpResponseHeaders(annotated); + }); + +const clearExistingSession = ( + config: DurableObjectStoreConfig, + sessionId: string, + request?: Request, +): Effect.Effect => + Effect.gen(function* () { + const stub = config.getStub(sessionId); + // Disposal carries the active request's trace context (tracestate/baggage) + // when the envelope forwards the inbound request (the Forbidden-with-session + // teardown); otherwise a synthetic request, with traceparent still linking + // the span via the active Effect span. + const propagation = yield* currentPropagationHeaders( + request ?? new Request("https://mcp.invalid/mcp"), + ); + yield* Effect.promise(() => stub.clearSession(propagation)).pipe( + Effect.catchCause(() => Effect.void), + Effect.withSpan("mcp.do.clear_session", { + attributes: { "mcp.request.session_id_present": true }, + }), + ); + }); + +/** + * Build the `McpSessionStore` seam over a host's DO namespace. Cloud and + * host-cloudflare each pass their `getStub`/`newStub` (over `env.MCP_SESSION`); + * the dispatch logic is identical. + */ +export const makeDurableObjectMcpSessionStore = ( + config: DurableObjectStoreConfig, +): Layer.Layer => + Layer.succeed(McpSessionStore)({ + dispatch: ({ + request, + principal, + sessionId, + }: McpDispatchInput): Effect.Effect => { + const token: VerifiedTokenHeaders = { + accountId: principal.accountId, + organizationId: principal.organizationId, + }; + return sessionId + ? forwardToExistingSession(config, request, sessionId, request.method !== "GET", token) + : createSession(config, request, token); + }, + dispose: (sessionId, request) => clearExistingSession(config, sessionId, request), + }); From cb91499b8fd341d5ddfbcf4589816d2a20842d2a Mon Sep 17 00:00:00 2001 From: Rhys Sullivan Date: Sun, 31 May 2026 12:09:32 -0700 Subject: [PATCH 17/31] Extract McpSessionDOBase abstract class into the shared package The 900-line cloud MCP session Durable Object splits into a platform-generic base (cold restore, inactivity alarm, owner validation, transport upgrade, per-request span bridge, browser-approval store) and a thin cloud subclass that binds only its injected dependencies via five seams: openSessionDb, resolveSessionMeta, buildMcpServer, and the optional withTelemetry / captureCause hooks. host-cloudflare will bind the same base to D1. --- apps/cloud/src/mcp/session-durable-object.ts | 909 ++---------------- .../src/mcp/session-durable-object.ts | 837 ++++++++++++++++ 2 files changed, 943 insertions(+), 803 deletions(-) create mode 100644 packages/hosts/cloudflare/src/mcp/session-durable-object.ts diff --git a/apps/cloud/src/mcp/session-durable-object.ts b/apps/cloud/src/mcp/session-durable-object.ts index 64d633ef4..4c3a00721 100644 --- a/apps/cloud/src/mcp/session-durable-object.ts +++ b/apps/cloud/src/mcp/session-durable-object.ts @@ -1,26 +1,35 @@ // --------------------------------------------------------------------------- -// MCP Session Durable Object — holds MCP server + engine per session +// Cloud MCP Session Durable Object — the cloud binding of the shared +// `McpSessionDOBase` (@executor-js/cloudflare). All session lifecycle (cold +// restore, the inactivity alarm, owner validation, transport upgrade, the +// browser-approval store, the per-request span bridge) lives in the base; cloud +// supplies ONLY its injected dependencies: +// - openSessionDb → a long-lived postgres.js handle +// - resolveSessionMeta → WorkOS/UserStore organization resolution +// - buildMcpServer → the cloud execution stack + MCP tool server +// - withTelemetry → the WebSdk tracer + W3C parent-span stitching +// - captureCause → Sentry error capture +// host-cloudflare binds the same base to D1 instead; the two stay byte-identical +// except for these seams. // --------------------------------------------------------------------------- -import { DurableObject, env } from "cloudflare:workers"; +import { env } from "cloudflare:workers"; import { createTraceState } from "@opentelemetry/api"; -import { Cause, Data, Deferred, Effect, Layer } from "effect"; +import { Data, Effect, Layer } from "effect"; +import type { Cause } from "effect"; import * as OtelTracer from "@effect/opentelemetry/Tracer"; -import type * as Tracer from "effect/Tracer"; -import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js"; -import type { TransportState } from "agents/mcp"; import { drizzle } from "drizzle-orm/postgres-js"; import postgres, { type Sql } from "postgres"; -import { jsonRpcErrorBody } from "@executor-js/host-mcp"; import { createExecutorMcpServer } from "@executor-js/host-mcp/tool-server"; +import { buildExecuteDescription } from "@executor-js/execution"; import { - buildExecuteDescription, - formatPausedExecution, - type ExecutionEngine, - type ResumeResponse, -} from "@executor-js/execution"; -import type { DrizzleDb, DbServiceShape } from "../db/db"; + McpSessionDOBase, + type BuiltMcpServer, + type IncomingTraceHeaders, + type McpSessionInit, + type SessionMeta, +} from "@executor-js/cloudflare/mcp/durable-object"; // The DO only needs the neutral boot-scoped service (WorkOSClient). It never // bills, so it does NOT depend on any billing service — `CloudExecutionStackLayer` @@ -30,122 +39,46 @@ import type { DrizzleDb, DbServiceShape } from "../db/db"; import { CoreSharedServices } from "../api/core-shared-services"; import { UserStoreService } from "../auth/context"; import { resolveOrganization } from "../auth/organization"; -import { DbService, combinedSchema, resolveConnectionString } from "../db/db"; -import { CloudExecutionStackLayer, makeExecutionStack } from "../engine/execution-stack"; import { - makeMcpWorkerTransport, - type McpWorkerTransport, -} from "@executor-js/cloudflare/mcp/worker-transport"; + DbService, + combinedSchema, + resolveConnectionString, + type DrizzleDb, + type DbServiceShape, +} from "../db/db"; +import { CloudExecutionStackLayer, makeExecutionStack } from "../engine/execution-stack"; import { DoTelemetryLive } from "../observability/telemetry"; -import { captureCause } from "../observability"; -import { - INTERNAL_ACCOUNT_ID_HEADER, - INTERNAL_ORGANIZATION_ID_HEADER, -} from "@executor-js/cloudflare/mcp/do-headers"; +import { captureCause as reportCause } from "../observability"; + +// Re-export the shared types so existing cloud importers +// (`auth/handlers.ts`, etc.) keep their `../mcp/session-durable-object` path. +export type { + McpApprovalOwner, + McpSessionApprovalResult, + McpSessionResumeApprovalResult, + McpSessionInit, + IncomingTraceHeaders, +} from "@executor-js/cloudflare/mcp/durable-object"; // --------------------------------------------------------------------------- -// Types +// Cloud DB handle — one postgres.js client per session runtime // --------------------------------------------------------------------------- -export type McpSessionInit = { - organizationId: string; - userId: string; - elicitationMode?: "browser" | "model" | "native"; - allowModelResume?: boolean; -}; - -export type IncomingTraceHeaders = { - readonly traceparent?: string; - readonly tracestate?: string; - readonly baggage?: string; -}; - -export type McpApprovalOwner = { - readonly accountId: string; - readonly organizationId: string; -}; - -type McpSessionApprovalErrorResult = - | { readonly status: "not_found" } - | { readonly status: "forbidden" }; - -export type McpSessionApprovalResult = - | { - readonly status: "ok"; - readonly text: string; - readonly structured: Record; - } - | McpSessionApprovalErrorResult; - -export type McpSessionResumeApprovalResult = - | { - readonly status: "ok"; - readonly executionStatus: "completed" | "paused"; - readonly text: string; - readonly structured: Record; - readonly isError?: boolean; - } - | McpSessionApprovalErrorResult; - -const resumeApprovalResult = ( - executionId: string, - response: ResumeResponse, -): Extract => { - const textByAction = { - accept: "I've approved it", - decline: "I've denied it", - cancel: "I've canceled it", - } satisfies Record; - const statusByAction = { - accept: "approved", - decline: "denied", - cancel: "canceled", - } satisfies Record; - - return { - status: "ok", - executionStatus: "completed", - text: textByAction[response.action], - structured: { status: statusByAction[response.action], executionId }, - isError: false, - }; -}; - -const HEARTBEAT_MS = 30 * 1000; -const SESSION_TIMEOUT_MS = 5 * 60 * 1000; const LONG_LIVED_DB_IDLE_TIMEOUT_SECONDS = 5; const LONG_LIVED_DB_MAX_LIFETIME_SECONDS = 120; -const TRANSPORT_STATE_KEY = "transport"; -const SESSION_META_KEY = "session-meta"; -const LAST_ACTIVITY_KEY = "last-activity-ms"; -const approvalResponseKey = (executionId: string) => `approval-response:${executionId}`; -// --------------------------------------------------------------------------- -// Errors -// --------------------------------------------------------------------------- +type CloudSessionDbHandle = DbServiceShape & { + readonly sql: Sql; + readonly end: () => Promise; +}; class OrganizationNotFoundError extends Data.TaggedError("OrganizationNotFoundError")<{ readonly organizationId: string; }> {} -// --------------------------------------------------------------------------- -// Helpers -// --------------------------------------------------------------------------- - -// The DO's JSON-RPC error bodies are INNER responses (no CORS): the edge worker -// re-wraps them with CORS before they leave the origin, so the canonical -// renderer is called with `cors: false` to stay byte-identical to the prior -// hand-rolled copy (`content-type: application/json` only). -const jsonRpcError = (status: number, code: number, message: string) => - jsonRpcErrorBody(status, code, message, { cors: false }); - -const sessionOwnerMismatch = () => - jsonRpcError(403, -32003, "MCP session does not belong to the current bearer"); - -// W3C propagation across the worker→DO boundary. mcp.ts injects the worker's -// `traceparent` and forwards incoming `tracestate` / `baggage` headers on -// forwarded requests (and as a second arg to `init()`). We parse the context -// here and use `OtelTracer.withSpanContext` to stitch the DO's root span +// W3C propagation across the worker→DO boundary. The worker injects its +// `traceparent` and forwards incoming `tracestate` / `baggage`; we parse the +// context and use `OtelTracer.withSpanContext` to stitch the DO's root span // under the worker span so the entire logical request lives in one trace. const TRACEPARENT_PATTERN = /^([0-9a-f]{2})-([0-9a-f]{32})-([0-9a-f]{16})-([0-9a-f]{2})$/; @@ -160,9 +93,8 @@ const parseTraceparent = ( traceparent: string | null | undefined, tracestate: string | null | undefined, ): IncomingSpanContext | null => { - const value = traceparent; - if (!value) return null; - const match = TRACEPARENT_PATTERN.exec(value); + if (!traceparent) return null; + const match = TRACEPARENT_PATTERN.exec(traceparent); if (!match) return null; return { traceId: match[2]!, @@ -172,26 +104,7 @@ const parseTraceparent = ( }; }; -const withIncomingParent = ( - incoming: IncomingTraceHeaders | null | undefined, - effect: Effect.Effect, -): Effect.Effect => { - const parsed = parseTraceparent(incoming?.traceparent, incoming?.tracestate); - return parsed ? OtelTracer.withSpanContext(effect, parsed) : effect; -}; - -type DbHandle = DbServiceShape & { readonly sql: Sql; end: () => Promise }; -type SessionMeta = { - readonly organizationId: string; - readonly organizationName: string; - readonly userId: string; - readonly elicitationMode?: "browser" | "model" | "native"; - readonly allowModelResume?: boolean; -}; - /** - * Base DB handle factory for MCP session runtimes. - * * The DO keeps one postgres.js client for the MCP session runtime. postgres.js * closes idle sockets quickly, while the runtime object stays alive so the MCP * server can preserve session-local protocol state across requests. @@ -199,9 +112,8 @@ type SessionMeta = { const makeDbHandle = (options: { readonly idleTimeout: number; readonly maxLifetime: number; -}): DbHandle => { - const connectionString = resolveConnectionString(); - const sql = postgres(connectionString, { +}): CloudSessionDbHandle => { + const sql = postgres(resolveConnectionString(), { max: 1, idle_timeout: options.idleTimeout, max_lifetime: options.maxLifetime, @@ -218,146 +130,57 @@ const makeDbHandle = (options: { }; }; -const makeLongLivedDb = (): DbHandle => - makeDbHandle({ - idleTimeout: LONG_LIVED_DB_IDLE_TIMEOUT_SECONDS, - maxLifetime: LONG_LIVED_DB_MAX_LIFETIME_SECONDS, - }); - -const makeEphemeralDb = (): DbHandle => makeDbHandle({ idleTimeout: 0, maxLifetime: 60 }); +const makeEphemeralDb = (): CloudSessionDbHandle => + makeDbHandle({ idleTimeout: 0, maxLifetime: 60 }); -const makeResolveOrganizationServices = (dbHandle: DbHandle) => { +// The org-resolution + session-runtime services. They DON'T re-provide +// `DoTelemetryLive` — that would install a second WebSdk tracer in the nested +// Effect scope, disconnecting every child span from the outer DO-method trace. +// Tracer comes from the outermost `withTelemetry` at the DO method boundary. +const makeSessionServices = (dbHandle: CloudSessionDbHandle) => { const DbLive = Layer.succeed(DbService)({ sql: dbHandle.sql, db: dbHandle.db }); const UserStoreLive = UserStoreService.Live.pipe(Layer.provide(DbLive)); return Layer.mergeAll(DbLive, UserStoreLive, CoreSharedServices); }; -// Session services DON'T re-provide `DoTelemetryLive` — that would install a -// second WebSdk tracer in the nested Effect scope, disconnecting every -// child span from the outer `McpSessionDO.init` / `McpSessionDO.handleRequest` -// trace. Tracer comes from the outermost `Effect.provide(DoTelemetryLive)` -// at the DO method boundary. -const makeSessionServices = (dbHandle: DbHandle) => makeResolveOrganizationServices(dbHandle); - -const resolveSessionMeta = Effect.fn("McpSessionDO.resolveSessionMeta")(function* ( - organizationId: string, - userId: string, - elicitationMode: "browser" | "model" | "native", -) { - const org = yield* resolveOrganization(organizationId); - if (!org) { - return yield* new OrganizationNotFoundError({ organizationId }); - } - return { - organizationId: org.id, - organizationName: org.name, - userId, - elicitationMode, - } satisfies SessionMeta; -}); - // --------------------------------------------------------------------------- // Durable Object // --------------------------------------------------------------------------- -export class McpSessionDO extends DurableObject { - private readonly instanceCreatedAt = Date.now(); - private mcpServer: McpServer | null = null; - private transport: McpWorkerTransport | null = null; - private engine: ExecutionEngine | null = null; - private initialized = false; - private lastActivityMs = 0; - private dbHandle: DbHandle | null = null; - private sessionMeta: SessionMeta | null = null; - private transportJsonResponseMode: boolean | null = null; - private approvalResponses = new Map(); - private approvalWaiters = new Map>(); - // Updated at the start of each `handleRequest` so the host-mcp server's - // `parentSpan` getter — invoked by the MCP SDK's deferred tool callbacks - // after `transport.handleRequest()` has already returned its streaming - // Response — can hand back the request-scoped span. The server is - // session-scoped (a fresh server-per-request would lose the elicitation - // request → reply correlation that the SDK keeps in-memory on the - // `Server` instance), so we have to bridge a per-request value through - // a per-session reference. - private currentRequestSpan: Tracer.AnySpan | null = null; - - private makeStorage() { - return { - get: async (): Promise => { - return await this.ctx.storage.get(TRANSPORT_STATE_KEY); - }, - set: async (state: TransportState): Promise => { - await this.ctx.storage.put(TRANSPORT_STATE_KEY, state); - }, - }; - } - - private loadSessionMeta(): Effect.Effect { - return Effect.promise(async () => { - if (this.sessionMeta) return this.sessionMeta; - const stored = await this.ctx.storage.get(SESSION_META_KEY); - this.sessionMeta = stored ?? null; - return this.sessionMeta; - }).pipe(Effect.withSpan("mcp.session.load_meta")); - } - - private async saveSessionMeta(sessionMeta: SessionMeta): Promise { - this.sessionMeta = sessionMeta; - await this.ctx.storage.put(SESSION_META_KEY, sessionMeta); - } - - private async markActivity(now = Date.now()): Promise { - this.lastActivityMs = now; - await Promise.all([ - this.ctx.storage.put(LAST_ACTIVITY_KEY, now), - this.ctx.storage.setAlarm(now + HEARTBEAT_MS), - ]); - } - - private async loadLastActivity(): Promise { - if (this.lastActivityMs > 0) return this.lastActivityMs; - const stored = await this.ctx.storage.get(LAST_ACTIVITY_KEY); - this.lastActivityMs = stored ?? 0; - return this.lastActivityMs; - } - - private entryAttrs(methodEnteredAt: number): Record { - const now = Date.now(); - return { - "mcp.do.instance_age_ms": now - this.instanceCreatedAt, - "mcp.do.method_entry_delay_ms": now - methodEnteredAt, - "mcp.session.session_id": this.ctx.id.toString(), - "mcp.session.initialized": this.initialized, - "mcp.session.has_transport": !!this.transport, - "mcp.session.has_meta_memory": !!this.sessionMeta, - }; +export class McpSessionDO extends McpSessionDOBase { + protected override openSessionDb(): CloudSessionDbHandle { + return makeDbHandle({ + idleTimeout: LONG_LIVED_DB_IDLE_TIMEOUT_SECONDS, + maxLifetime: LONG_LIVED_DB_MAX_LIFETIME_SECONDS, + }); } - private clearSessionState(): Effect.Effect { - return Effect.promise(async () => { - this.sessionMeta = null; - this.initialized = false; - this.lastActivityMs = 0; - this.transportJsonResponseMode = null; - - await Promise.all([ - // oxlint-disable-next-line executor/no-promise-catch -- boundary: Durable Object storage cleanup is best-effort after session invalidation - this.ctx.storage.delete(TRANSPORT_STATE_KEY).catch(() => false), - // oxlint-disable-next-line executor/no-promise-catch -- boundary: Durable Object storage cleanup is best-effort after session invalidation - this.ctx.storage.delete(SESSION_META_KEY).catch(() => false), - // oxlint-disable-next-line executor/no-promise-catch -- boundary: Durable Object storage cleanup is best-effort after session invalidation - this.ctx.storage.delete(LAST_ACTIVITY_KEY).catch(() => false), - // oxlint-disable-next-line executor/no-promise-catch -- boundary: Durable Object alarm cleanup is best-effort after session invalidation - this.ctx.storage.deleteAlarm().catch(() => undefined), - ]); - }).pipe(Effect.withSpan("mcp.session.clear_state")); + protected override resolveSessionMeta(token: McpSessionInit): Effect.Effect { + const dbHandle = makeEphemeralDb(); + return Effect.gen(function* () { + const org = yield* resolveOrganization(token.organizationId); + if (!org) { + return yield* new OrganizationNotFoundError({ organizationId: token.organizationId }); + } + return { + organizationId: org.id, + organizationName: org.name, + userId: token.userId, + elicitationMode: token.elicitationMode, + } satisfies SessionMeta; + }).pipe( + Effect.withSpan("McpSessionDO.resolveSessionMeta"), + Effect.provide(makeSessionServices(dbHandle)), + Effect.ensuring(Effect.promise(() => dbHandle.end())), + // oxlint-disable-next-line executor/no-effect-escape-hatch -- boundary: a vanished org is a defect; the worker already verified the bearer + Effect.orDie, + ); } - private createConnectedRuntime( + protected override buildMcpServer( sessionMeta: SessionMeta, - options: { readonly dbHandle: DbHandle; readonly enableJsonResponse?: boolean }, - ) { + dbHandle: CloudSessionDbHandle, + ): Effect.Effect { const self = this; return Effect.gen(function* () { const { executor, engine } = yield* makeExecutionStack( @@ -369,21 +192,17 @@ export class McpSessionDO extends DurableObject { Effect.withSpan("McpSessionDO.makeExecutionStack"), ); // Build the description here so the postgres query it runs - // (`executor.sources.list`) lands as a child of - // `McpSessionDO.createRuntime`. host-mcp would otherwise call - // `Effect.runPromise(engine.getDescription)` at its async - // MCP-SDK boundary and orphan the sub-span. + // (`executor.sources.list`) lands as a child of `McpSessionDO.createRuntime`. + // host-mcp would otherwise call `Effect.runPromise(engine.getDescription)` + // at its async MCP-SDK boundary and orphan the sub-span. const description = yield* buildExecuteDescription(executor); const sessionElicitationMode = sessionMeta.elicitationMode ?? "model"; const mcpServer = yield* createExecutorMcpServer({ engine, description, - parentSpan: () => self.currentRequestSpan ?? undefined, + parentSpan: () => self.currentParentSpan(), debug: env.EXECUTOR_MCP_DEBUG === "true", - browserApprovalStore: { - takeResponse: (executionId) => self.takeApprovalResponse(executionId), - waitForResponse: (executionId) => self.waitForApprovalResponse(executionId), - }, + browserApprovalStore: self.browserApprovalStore, elicitationMode: sessionElicitationMode === "browser" ? { @@ -391,547 +210,31 @@ export class McpSessionDO extends DurableObject { approvalUrl: (executionId) => { const origin = env.VITE_PUBLIC_SITE_URL ?? "https://executor.sh"; const url = new URL(`/resume/${encodeURIComponent(executionId)}`, origin); - url.searchParams.set("mcp_session_id", self.ctx.id.toString()); + url.searchParams.set("mcp_session_id", self.sessionId); return url.toString(); }, } : { mode: sessionElicitationMode }, }).pipe(Effect.withSpan("McpSessionDO.createExecutorMcpServer")); - const transport = yield* makeMcpWorkerTransport({ - sessionIdGenerator: () => self.ctx.id.toString(), - storage: self.makeStorage(), - enableJsonResponse: options.enableJsonResponse, - }); - self.transportJsonResponseMode = options.enableJsonResponse ?? false; - yield* transport.connect(mcpServer); - return { mcpServer, transport, engine }; - }).pipe( - Effect.withSpan("McpSessionDO.createRuntime"), - Effect.provide(makeSessionServices(options.dbHandle)), - ); - } - - private closeRuntime(): Effect.Effect { - const self = this; - return Effect.gen(function* () { - if (self.transport) { - yield* self.transport.close(); - self.transport = null; - } - if (self.mcpServer) { - const mcpServer = self.mcpServer; - // oxlint-disable-next-line executor/no-promise-catch -- boundary: MCP SDK close failure is ignored during best-effort runtime teardown - yield* Effect.promise(() => mcpServer.close().catch(() => undefined)); - self.mcpServer = null; - } - self.engine = null; - if (self.dbHandle) { - const dbHandle = self.dbHandle; - yield* Effect.promise(() => dbHandle.end()); - self.dbHandle = null; - } - self.initialized = false; - self.transportJsonResponseMode = null; - }).pipe( - // oxlint-disable-next-line executor/no-effect-escape-hatch -- boundary: DO cleanup has no typed failure surface - Effect.orDie, - ); - } - - private installRuntime( - sessionMeta: SessionMeta, - options: { - readonly dbHandle: DbHandle; - readonly enableJsonResponse: boolean; - }, - ) { - const self = this; - return Effect.gen(function* () { - const runtime = yield* self.createConnectedRuntime(sessionMeta, options); - self.dbHandle = options.dbHandle; - self.mcpServer = runtime.mcpServer; - self.transport = runtime.transport; - self.engine = runtime.engine; - self.initialized = true; - }); - } - - private ensureRuntimeForApproval(): Effect.Effect { - const self = this; - return Effect.gen(function* () { - if (self.initialized && self.engine) return true; - - const sessionMeta = yield* self.loadSessionMeta(); - if (!sessionMeta) return false; - - yield* self.closeRuntime(); - const dbHandle = makeLongLivedDb(); - yield* self.installRuntime(sessionMeta, { - dbHandle, - enableJsonResponse: true, - }); - yield* Effect.promise(() => self.markActivity()).pipe( - Effect.withSpan("McpSessionDO.markActivity"), - ); - return true; - }).pipe( - Effect.withSpan("McpSessionDO.ensure_runtime_for_approval"), - // oxlint-disable-next-line executor/no-effect-escape-hatch -- boundary: DO RPC has no typed Effect channel - Effect.orDie, - ); - } - - private validateApprovalIdentity( - identity: McpApprovalOwner, - ): Effect.Effect<"ok" | "not_found" | "forbidden"> { - const self = this; - return Effect.gen(function* () { - const sessionMeta = yield* self.loadSessionMeta(); - if (!sessionMeta) return "not_found" as const; - - const matches = - identity.accountId === sessionMeta.userId && - identity.organizationId === sessionMeta.organizationId; - - yield* Effect.annotateCurrentSpan({ - "mcp.session.owner_match": matches, - }); - - return matches ? ("ok" as const) : ("forbidden" as const); - }).pipe(Effect.withSpan("mcp.session.validate_approval_identity")); - } - - private restoreRuntimeFromStorage(request: Request): Effect.Effect<"restored" | "missing_meta"> { - const self = this; - return Effect.gen(function* () { - if (self.initialized && self.transport) return "restored" as const; - - const sessionMeta = yield* self.loadSessionMeta(); - if (!sessionMeta) { - yield* Effect.annotateCurrentSpan({ - "mcp.session.restore.outcome": "missing_meta", - }); - return "missing_meta" as const; - } - - yield* self.closeRuntime(); - const dbHandle = makeLongLivedDb(); - yield* self.installRuntime(sessionMeta, { - dbHandle, - // GET always returns an SSE stream regardless of this option, but the - // session-scoped transport is reused by later POSTs. Keep JSON mode on - // across cold restores so a GET reconnect cannot poison future POSTs. - enableJsonResponse: true, - }); - yield* Effect.promise(() => self.markActivity()).pipe( - Effect.withSpan("McpSessionDO.markActivity"), - ); - yield* Effect.annotateCurrentSpan({ - "mcp.session.restore.outcome": "restored", - }); - return "restored" as const; - }).pipe( - Effect.withSpan("McpSessionDO.restoreRuntime", { - attributes: { - "mcp.request.method": request.method, - "mcp.request.session_id_present": !!request.headers.get("mcp-session-id"), - }, - }), - // oxlint-disable-next-line executor/no-effect-escape-hatch -- boundary: cold DO restore is re-entered from Promise-only Durable Object method - Effect.orDie, - ); - } - - private ensureJsonResponseTransportForPost(request: Request): Effect.Effect { - const self = this; - return Effect.gen(function* () { - if (request.method !== "POST" || self.transportJsonResponseMode === true) return; - - const sessionMeta = yield* self.loadSessionMeta(); - if (!sessionMeta) return; - - yield* self.closeRuntime(); - const dbHandle = makeLongLivedDb(); - yield* self.installRuntime(sessionMeta, { - dbHandle, - enableJsonResponse: true, - }); - yield* Effect.annotateCurrentSpan({ - "mcp.session.transport_upgraded_json_response": true, - }); - }).pipe( - Effect.withSpan("McpSessionDO.ensureJsonResponseTransportForPost"), - // oxlint-disable-next-line executor/no-effect-escape-hatch -- boundary: transport rebuild is internal DO runtime state - Effect.orDie, - ); - } - - private validateSessionOwner(request: Request): Effect.Effect { - const self = this; - return Effect.gen(function* () { - const sessionMeta = yield* self.loadSessionMeta(); - if (!sessionMeta) return null; - - const accountId = request.headers.get(INTERNAL_ACCOUNT_ID_HEADER); - const organizationId = request.headers.get(INTERNAL_ORGANIZATION_ID_HEADER); - const matches = - accountId === sessionMeta.userId && organizationId === sessionMeta.organizationId; - - yield* Effect.annotateCurrentSpan({ - "mcp.session.owner_match": matches, - }); - - return matches ? null : sessionOwnerMismatch(); - }).pipe(Effect.withSpan("mcp.session.validate_owner")); - } - - private resolveAndStoreSessionMeta(token: McpSessionInit) { - const self = this; - return Effect.gen(function* () { - const dbHandle = makeEphemeralDb(); - return yield* resolveSessionMeta( - token.organizationId, - token.userId, - token.elicitationMode ?? "model", - ).pipe( - Effect.provide(makeResolveOrganizationServices(dbHandle)), - Effect.tap((sessionMeta) => - Effect.promise(() => self.saveSessionMeta(sessionMeta)).pipe( - Effect.withSpan("mcp.session.save_meta"), - ), - ), - Effect.ensuring(Effect.promise(() => dbHandle.end())), - ); - }).pipe(Effect.withSpan("mcp.session.resolve_and_store_meta")); - } - - async init(token: McpSessionInit, incoming?: IncomingTraceHeaders): Promise { - const methodEnteredAt = Date.now(); - if (this.initialized) return; - const self = this; - return Effect.runPromise( - Effect.gen(function* () { - yield* Effect.annotateCurrentSpan(self.entryAttrs(methodEnteredAt)); - yield* self.doInit(token); - }).pipe( - Effect.withSpan("McpSessionDO.init", { - attributes: { "mcp.auth.organization_id": token.organizationId }, - }), - (eff) => withIncomingParent(incoming, eff), - Effect.provide(DoTelemetryLive), - // oxlint-disable-next-line executor/no-effect-escape-hatch -- boundary: Durable Object init method can only reject its Promise - Effect.orDie, - ), - ); - } - - private doInit(token: McpSessionInit) { - const self = this; - // Single Effect chain so every sub-span (resolveSessionMeta, - // createRuntime, createScopedExecutor, createExecutorMcpServer, - // transport.connect, storage.setAlarm) lands as a child of - // `McpSessionDO.init`. The prior implementation called - // `Effect.runPromise` nested inside an async function, which orphaned - // each sub-span into its own root trace and made init opaque — - // dashboard saw one 2.77s span with nothing under it. - return Effect.gen(function* () { - const sessionMeta = yield* self.resolveAndStoreSessionMeta(token); - - self.dbHandle = makeLongLivedDb(); - // POST responses go out as JSON so `transport.handleRequest()` awaits - // every MCP tool callback before resolving — keeps engine spans inside - // the outer `handleRequest` Effect's fiber so `currentRequestSpan` is - // still set when the host-mcp `parentSpan` getter reads it. With SSE - // POSTs the callback fires after `Effect.ensuring` clears the field - // and engine spans orphan into new root traces. GET still streams - // (the GET handler doesn't consult `enableJsonResponse`). - const runtime = yield* self.createConnectedRuntime(sessionMeta, { - dbHandle: self.dbHandle, - enableJsonResponse: true, - }); - self.mcpServer = runtime.mcpServer; - self.transport = runtime.transport; - self.engine = runtime.engine; - - self.initialized = true; - yield* Effect.promise(() => self.markActivity()).pipe( - Effect.withSpan("McpSessionDO.markActivity"), - ); + return { mcpServer, engine } satisfies BuiltMcpServer; }).pipe( - Effect.tapCause((cause) => - Effect.sync(() => { - console.error("[mcp-session] init failed:", cause); - }), - ), - Effect.catchCause((cause) => - Effect.gen(function* () { - yield* Effect.promise(() => self.cleanup()); - return yield* Effect.failCause(cause); - }), - ), - // oxlint-disable-next-line executor/no-effect-escape-hatch -- boundary: doInit is called only from Promise-only Durable Object init + Effect.withSpan("McpSessionDO.buildMcpServer"), + Effect.provide(makeSessionServices(dbHandle)), + // oxlint-disable-next-line executor/no-effect-escape-hatch -- boundary: runtime-build failures surface as the base's tapCause/cleanup defect Effect.orDie, ); } - async handleRequest(request: Request): Promise { - const methodEnteredAt = Date.now(); - // Wrap the dispatch in an Effect span so every DO request — not just - // the rare new-session `init()` — shows up in Axiom. Basic attributes - // only (method, session-id presence, response status); rich client - // fingerprint stays on the edge `mcp.request` span, which shares a - // trace_id with this one. - const incoming = { - traceparent: request.headers.get("traceparent") ?? undefined, - tracestate: request.headers.get("tracestate") ?? undefined, - baggage: request.headers.get("baggage") ?? undefined, - } satisfies IncomingTraceHeaders; - const self = this; - const program = Effect.gen(function* () { - yield* Effect.annotateCurrentSpan(self.entryAttrs(methodEnteredAt)); - // Capture the request-entry span so the host-mcp `parentSpan` getter - // — fired by deferred MCP SDK callbacks after this Effect has already - // returned — anchors engine spans under the same trace. Cleared in a - // finalizer so a future request that arrives without a fresh span - // doesn't accidentally inherit a stale one. - const span = yield* Effect.currentSpan; - self.currentRequestSpan = span; - - return yield* self.dispatchRequest(request).pipe( - Effect.tap((response) => - Effect.annotateCurrentSpan({ - "mcp.response.status_code": response.status, - "mcp.response.content_type": response.headers.get("content-type") ?? "", - "mcp.transport.enable_json_response": self.transportJsonResponseMode ?? false, - }), - ), - Effect.ensuring( - Effect.sync(() => { - self.currentRequestSpan = null; - }), - ), - ); - }).pipe( - Effect.withSpan("McpSessionDO.handleRequest", { - attributes: { - "mcp.request.method": request.method, - "mcp.request.session_id_present": !!request.headers.get("mcp-session-id"), - }, - }), - (eff) => withIncomingParent(incoming, eff), - Effect.provide(DoTelemetryLive), - ); - return Effect.runPromise(program); - } - - async getPausedExecutionForApproval( - executionId: string, - identity: McpApprovalOwner, - incoming?: IncomingTraceHeaders, - ): Promise { - const self = this; - return Effect.runPromise( - Effect.gen(function* () { - const owner = yield* self.validateApprovalIdentity(identity); - if (owner !== "ok") return { status: owner } as const; - - const restored = yield* self.ensureRuntimeForApproval(); - if (!restored || !self.engine) return { status: "not_found" } as const; - - const paused = yield* self.engine.getPausedExecution(executionId); - if (!paused) return { status: "not_found" } as const; - - const formatted = formatPausedExecution(paused); - return { - status: "ok" as const, - text: formatted.text, - structured: formatted.structured, - }; - }).pipe( - Effect.withSpan("McpSessionDO.getPausedExecutionForApproval", { - attributes: { "mcp.execution.id": executionId }, - }), - (eff) => withIncomingParent(incoming, eff), - Effect.provide(DoTelemetryLive), - // oxlint-disable-next-line executor/no-effect-escape-hatch -- boundary: DO RPC exposes Promise results - Effect.orDie, - ), - ); - } - - private takeApprovalResponse(executionId: string): Effect.Effect { - const self = this; - return Effect.promise(async () => { - const memoryResponse = self.approvalResponses.get(executionId); - if (memoryResponse) { - self.approvalResponses.delete(executionId); - await self.ctx.storage.delete(approvalResponseKey(executionId)); - return memoryResponse; - } - const stored = await self.ctx.storage.get(approvalResponseKey(executionId)); - if (!stored) return null; - await self.ctx.storage.delete(approvalResponseKey(executionId)); - return stored; - }); - } - - private waitForApprovalResponse(executionId: string): Effect.Effect { - const self = this; - return Effect.gen(function* () { - const existing = yield* self.takeApprovalResponse(executionId); - if (existing) return existing; - - const waiter = - self.approvalWaiters.get(executionId) ?? (yield* Deferred.make()); - self.approvalWaiters.set(executionId, waiter); - yield* Deferred.await(waiter).pipe( - Effect.ensuring( - Effect.sync(() => { - if (self.approvalWaiters.get(executionId) === waiter) { - self.approvalWaiters.delete(executionId); - } - }), - ), - ); - return yield* self.takeApprovalResponse(executionId); - }); - } - - async resumeExecutionForApproval( - executionId: string, - identity: McpApprovalOwner, - response: ResumeResponse, + protected override withTelemetry( + effect: Effect.Effect, incoming?: IncomingTraceHeaders, - ): Promise { - const self = this; - return Effect.runPromise( - Effect.gen(function* () { - const owner = yield* self.validateApprovalIdentity(identity); - if (owner !== "ok") return { status: owner } as const; - - const restored = yield* self.ensureRuntimeForApproval(); - if (!restored || !self.engine) return { status: "not_found" } as const; - - const paused = yield* self.engine.getPausedExecution(executionId); - if (!paused) return { status: "not_found" } as const; - - self.approvalResponses.set(executionId, response); - yield* Effect.promise(() => - self.ctx.storage.put(approvalResponseKey(executionId), response), - ); - const waiter = self.approvalWaiters.get(executionId); - if (waiter) yield* Deferred.succeed(waiter, response); - return resumeApprovalResult(executionId, response); - }).pipe( - Effect.withSpan("McpSessionDO.resumeExecutionForApproval", { - attributes: { "mcp.execution.id": executionId }, - }), - (eff) => withIncomingParent(incoming, eff), - Effect.provide(DoTelemetryLive), - // oxlint-disable-next-line executor/no-effect-escape-hatch -- boundary: DO RPC exposes Promise results - Effect.orDie, - ), - ); - } - - private dispatchRequest(request: Request): Effect.Effect { - const self = this; - return Effect.gen(function* () { - const ownerError = yield* self.validateSessionOwner(request); - if (ownerError) return ownerError; - return yield* self.dispatchAuthorizedRequest(request); - }); - } - - private dispatchAuthorizedRequest(request: Request): Effect.Effect { - if (!this.initialized || !this.transport) { - if (request.method === "DELETE") { - return this.clearSessionState().pipe( - Effect.as(new Response(null, { status: 204 })), - Effect.withSpan("mcp.session.stale_delete"), - ); - } - const self = this; - return Effect.gen(function* () { - const restored = yield* self.restoreRuntimeFromStorage(request); - if (restored === "restored") { - return yield* self.dispatchAuthorizedRequest(request); - } - return jsonRpcError(404, -32001, "Session timed out due to inactivity — please reconnect"); - }); - } - - const self = this; - return Effect.gen(function* () { - yield* self.ensureJsonResponseTransportForPost(request); - const transport = self.transport; - if (!transport) { - return jsonRpcError(404, -32001, "Session timed out due to inactivity — please reconnect"); - } - - yield* Effect.promise(() => self.markActivity()).pipe( - Effect.withSpan("McpSessionDO.markActivity"), - ); - const response = yield* transport.handleRequest(request).pipe( - Effect.withSpan("McpSessionDO.transport.handleRequest", { - attributes: { - "mcp.request.method": request.method, - "mcp.request.content_type": request.headers.get("content-type") ?? "", - "mcp.request.content_length": request.headers.get("content-length") ?? "", - }, - }), - ); - yield* Effect.annotateCurrentSpan({ - "mcp.response.status_code": response.status, - "mcp.response.content_type": response.headers.get("content-type") ?? "", - "mcp.transport.enable_json_response": self.transportJsonResponseMode ?? false, - }); - if (request.method === "DELETE") { - yield* Effect.promise(() => self.cleanup()).pipe(Effect.withSpan("mcp.session.cleanup")); - } - return response; - }).pipe( - Effect.catchCause((cause) => - Effect.sync(() => { - console.error("[mcp-session] handleRequest error:", Cause.pretty(cause)); - captureCause(cause); - return jsonRpcError(500, -32603, "Internal error"); - }), - ), - ); - } - - async alarm(): Promise { - const program = Effect.promise(() => this.runAlarm()).pipe( - Effect.withSpan("McpSessionDO.alarm"), - Effect.provide(DoTelemetryLive), - ); - return Effect.runPromise(program); - } - - async clearSession(incoming?: IncomingTraceHeaders): Promise { - return Effect.runPromise( - Effect.promise(() => this.cleanup()).pipe( - Effect.withSpan("McpSessionDO.clearSession"), - (eff) => withIncomingParent(incoming, eff), - Effect.provide(DoTelemetryLive), - ), - ); - } - - private async runAlarm(): Promise { - const lastActivityMs = await this.loadLastActivity(); - const idleMs = Date.now() - lastActivityMs; - if (idleMs >= SESSION_TIMEOUT_MS) { - await Effect.runPromise(this.closeRuntime()); - await this.ctx.storage.deleteAlarm(); - return; - } - await this.ctx.storage.setAlarm(Date.now() + HEARTBEAT_MS); + ): Effect.Effect { + const parsed = parseTraceparent(incoming?.traceparent, incoming?.tracestate); + const traced = parsed ? OtelTracer.withSpanContext(effect, parsed) : effect; + return traced.pipe(Effect.provide(DoTelemetryLive)); } - private async cleanup(): Promise { - await Effect.runPromise(this.closeRuntime()); - await Effect.runPromise(this.clearSessionState()); + protected override captureCause(cause: Cause.Cause): void { + reportCause(cause); } } diff --git a/packages/hosts/cloudflare/src/mcp/session-durable-object.ts b/packages/hosts/cloudflare/src/mcp/session-durable-object.ts new file mode 100644 index 000000000..aca490ee8 --- /dev/null +++ b/packages/hosts/cloudflare/src/mcp/session-durable-object.ts @@ -0,0 +1,837 @@ +// --------------------------------------------------------------------------- +// Shared MCP Session Durable Object base — holds the MCP server + engine for ONE +// session in a single addressable isolate (the DO id IS the mcp-session-id), so +// every follow-up request routes back to the same isolate. Owns ALL the +// platform-generic lifecycle (cold-restore from ctx.storage, the inactivity +// alarm, owner validation, the JSON-response-mode transport upgrade, the +// per-request→per-session span bridge, the browser-approval store). A host +// supplies only the seams: openSessionDb / resolveSessionMeta / buildMcpServer, +// and optionally withTelemetry / captureCause. cloud and host-cloudflare each +// become a ~100-line subclass binding their injected dependencies. +// --------------------------------------------------------------------------- + +import { DurableObject } from "cloudflare:workers"; +import { Cause, Deferred, Effect } from "effect"; +import type * as Tracer from "effect/Tracer"; +import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js"; +import type { TransportState } from "agents/mcp"; + +import { jsonRpcErrorBody } from "@executor-js/host-mcp"; +import { + formatPausedExecution, + type ExecutionEngine, + type ResumeResponse, +} from "@executor-js/execution"; + +import { makeMcpWorkerTransport, type McpWorkerTransport } from "./worker-transport"; +import { + INTERNAL_ACCOUNT_ID_HEADER, + INTERNAL_ORGANIZATION_ID_HEADER, + type IncomingPropagationHeaders, +} from "./do-headers"; +import type { McpSessionInit } from "./seams"; + +// --------------------------------------------------------------------------- +// Types +// --------------------------------------------------------------------------- + +export type { McpSessionInit } from "./seams"; + +/** The W3C trace headers the worker forwards to the DO (same shape as the + * dispatcher's propagation headers). */ +export type IncomingTraceHeaders = IncomingPropagationHeaders; + +export type McpApprovalOwner = { + readonly accountId: string; + readonly organizationId: string; +}; + +type McpSessionApprovalErrorResult = + | { readonly status: "not_found" } + | { readonly status: "forbidden" }; + +export type McpSessionApprovalResult = + | { + readonly status: "ok"; + readonly text: string; + readonly structured: Record; + } + | McpSessionApprovalErrorResult; + +export type McpSessionResumeApprovalResult = + | { + readonly status: "ok"; + readonly executionStatus: "completed" | "paused"; + readonly text: string; + readonly structured: Record; + readonly isError?: boolean; + } + | McpSessionApprovalErrorResult; + +const resumeApprovalResult = ( + executionId: string, + response: ResumeResponse, +): Extract => { + const textByAction = { + accept: "I've approved it", + decline: "I've denied it", + cancel: "I've canceled it", + } satisfies Record; + const statusByAction = { + accept: "approved", + decline: "denied", + cancel: "canceled", + } satisfies Record; + + return { + status: "ok", + executionStatus: "completed", + text: textByAction[response.action], + structured: { status: statusByAction[response.action], executionId }, + isError: false, + }; +}; + +const HEARTBEAT_MS = 30 * 1000; +const SESSION_TIMEOUT_MS = 5 * 60 * 1000; +const TRANSPORT_STATE_KEY = "transport"; +const SESSION_META_KEY = "session-meta"; +const LAST_ACTIVITY_KEY = "last-activity-ms"; +const approvalResponseKey = (executionId: string) => `approval-response:${executionId}`; + +// --------------------------------------------------------------------------- +// Helpers +// --------------------------------------------------------------------------- + +// The DO's JSON-RPC error bodies are INNER responses (no CORS): the edge worker +// re-wraps them with CORS before they leave the origin, so the canonical +// renderer is called with `cors: false` to stay byte-identical to the prior +// hand-rolled copy (`content-type: application/json` only). +const jsonRpcError = (status: number, code: number, message: string) => + jsonRpcErrorBody(status, code, message, { cors: false }); + +const sessionOwnerMismatch = () => + jsonRpcError(403, -32003, "MCP session does not belong to the current bearer"); + +// --------------------------------------------------------------------------- +// Host seams +// --------------------------------------------------------------------------- + +/** + * A host's per-session DB handle. The base only disposes it during runtime + * teardown; the host's `buildMcpServer` reads its concrete shape (postgres.js + * for cloud, the D1 `ExecutorDbHandle` for host-cloudflare). + */ +export interface SessionDbHandle { + readonly end: () => Promise | void; +} + +/** + * Resolved session identity + elicitation mode — the output of a host's + * `resolveSessionMeta`. Persisted to `ctx.storage` so a cold isolate can + * re-validate ownership and rebuild the runtime without re-resolving. + */ +export interface SessionMeta { + readonly organizationId: string; + readonly organizationName: string; + readonly userId: string; + readonly elicitationMode?: "browser" | "model" | "native"; +} + +/** What a host's `buildMcpServer` seam returns: the connected MCP server plus + * the engine the base drives for paused-execution approval flows. */ +export interface BuiltMcpServer { + readonly mcpServer: McpServer; + readonly engine: ExecutionEngine; +} + +/** The shared browser-approval store the base wires to its persisted approval + * responses; a host hands it to its MCP server when elicitation is "browser". */ +export interface BrowserApprovalStore { + readonly takeResponse: (executionId: string) => Effect.Effect; + readonly waitForResponse: (executionId: string) => Effect.Effect; +} + +// --------------------------------------------------------------------------- +// Durable Object base +// --------------------------------------------------------------------------- + +export abstract class McpSessionDOBase< + TDbHandle extends SessionDbHandle = SessionDbHandle, +> extends DurableObject { + private readonly instanceCreatedAt = Date.now(); + private mcpServer: McpServer | null = null; + private transport: McpWorkerTransport | null = null; + private engine: ExecutionEngine | null = null; + private initialized = false; + private lastActivityMs = 0; + private dbHandle: TDbHandle | null = null; + private sessionMeta: SessionMeta | null = null; + private transportJsonResponseMode: boolean | null = null; + private approvalResponses = new Map(); + private approvalWaiters = new Map>(); + // Updated at the start of each `handleRequest` so the host-mcp server's + // `parentSpan` getter — invoked by the MCP SDK's deferred tool callbacks + // after `transport.handleRequest()` has already returned its streaming + // Response — can hand back the request-scoped span. The server is + // session-scoped (a fresh server-per-request would lose the elicitation + // request → reply correlation that the SDK keeps in-memory on the + // `Server` instance), so we have to bridge a per-request value through + // a per-session reference. + private currentRequestSpan: Tracer.AnySpan | null = null; + + // ------------------------------------------------------------------------- + // Host seams — the ONLY platform-specific surface. A host subclass binds its + // DB driver, organization lookup, and MCP-server/engine construction; cloud + // adds telemetry + Sentry by overriding the two optional hooks. Everything + // else in this class is platform-generic. + // ------------------------------------------------------------------------- + + /** Open the per-session DB handle the runtime holds for this session's + * lifetime (postgres.js for cloud, the D1 handle for host-cloudflare). */ + protected abstract openSessionDb(): TDbHandle; + + /** Resolve + validate the session owner into the meta persisted to storage. + * Owns its own short-lived DB/services (it runs once per session create). */ + protected abstract resolveSessionMeta(token: McpSessionInit): Effect.Effect; + + /** Build the connected MCP server + engine for a resolved session. The host + * provides its execution stack + DB layers here; the base owns the transport + * and the per-request span / browser-approval wiring exposed below. */ + protected abstract buildMcpServer( + sessionMeta: SessionMeta, + dbHandle: TDbHandle, + ): Effect.Effect; + + /** Optional telemetry seam: stitch the DO span under the worker's incoming + * trace and install the host's tracer. Default is identity (no telemetry). */ + protected withTelemetry( + effect: Effect.Effect, + _incoming?: IncomingTraceHeaders, + ): Effect.Effect { + return effect; + } + + /** Optional error seam: report a fatal request cause (cloud → Sentry). */ + protected captureCause(_cause: Cause.Cause): void {} + + /** The session id — equal to this DO's id. */ + protected get sessionId(): string { + return this.ctx.id.toString(); + } + + /** The request-scoped span for the host-mcp `parentSpan` getter (read by + * deferred MCP SDK callbacks after the request Effect has returned). */ + protected currentParentSpan(): Tracer.AnySpan | undefined { + return this.currentRequestSpan ?? undefined; + } + + /** The browser-approval store wired to this session's persisted responses. */ + protected readonly browserApprovalStore: BrowserApprovalStore = { + takeResponse: (executionId) => this.takeApprovalResponse(executionId), + waitForResponse: (executionId) => this.waitForApprovalResponse(executionId), + }; + + private makeStorage() { + return { + get: async (): Promise => { + return await this.ctx.storage.get(TRANSPORT_STATE_KEY); + }, + set: async (state: TransportState): Promise => { + await this.ctx.storage.put(TRANSPORT_STATE_KEY, state); + }, + }; + } + + private loadSessionMeta(): Effect.Effect { + return Effect.promise(async () => { + if (this.sessionMeta) return this.sessionMeta; + const stored = await this.ctx.storage.get(SESSION_META_KEY); + this.sessionMeta = stored ?? null; + return this.sessionMeta; + }).pipe(Effect.withSpan("mcp.session.load_meta")); + } + + private async saveSessionMeta(sessionMeta: SessionMeta): Promise { + this.sessionMeta = sessionMeta; + await this.ctx.storage.put(SESSION_META_KEY, sessionMeta); + } + + private async markActivity(now = Date.now()): Promise { + this.lastActivityMs = now; + await Promise.all([ + this.ctx.storage.put(LAST_ACTIVITY_KEY, now), + this.ctx.storage.setAlarm(now + HEARTBEAT_MS), + ]); + } + + private async loadLastActivity(): Promise { + if (this.lastActivityMs > 0) return this.lastActivityMs; + const stored = await this.ctx.storage.get(LAST_ACTIVITY_KEY); + this.lastActivityMs = stored ?? 0; + return this.lastActivityMs; + } + + private entryAttrs(methodEnteredAt: number): Record { + const now = Date.now(); + return { + "mcp.do.instance_age_ms": now - this.instanceCreatedAt, + "mcp.do.method_entry_delay_ms": now - methodEnteredAt, + "mcp.session.session_id": this.ctx.id.toString(), + "mcp.session.initialized": this.initialized, + "mcp.session.has_transport": !!this.transport, + "mcp.session.has_meta_memory": !!this.sessionMeta, + }; + } + + private clearSessionState(): Effect.Effect { + return Effect.promise(async () => { + this.sessionMeta = null; + this.initialized = false; + this.lastActivityMs = 0; + this.transportJsonResponseMode = null; + + await Promise.all([ + // oxlint-disable-next-line executor/no-promise-catch -- boundary: Durable Object storage cleanup is best-effort after session invalidation + this.ctx.storage.delete(TRANSPORT_STATE_KEY).catch(() => false), + // oxlint-disable-next-line executor/no-promise-catch -- boundary: Durable Object storage cleanup is best-effort after session invalidation + this.ctx.storage.delete(SESSION_META_KEY).catch(() => false), + // oxlint-disable-next-line executor/no-promise-catch -- boundary: Durable Object storage cleanup is best-effort after session invalidation + this.ctx.storage.delete(LAST_ACTIVITY_KEY).catch(() => false), + // oxlint-disable-next-line executor/no-promise-catch -- boundary: Durable Object alarm cleanup is best-effort after session invalidation + this.ctx.storage.deleteAlarm().catch(() => undefined), + ]); + }).pipe(Effect.withSpan("mcp.session.clear_state")); + } + + private createConnectedRuntime( + sessionMeta: SessionMeta, + options: { readonly dbHandle: TDbHandle; readonly enableJsonResponse?: boolean }, + ) { + const self = this; + return Effect.gen(function* () { + // The host builds its MCP server + engine (execution stack, DB layers, + // elicitation policy); the base owns the worker transport so JSON-response + // mode, the session-id generator, and storage stay identical everywhere. + const { mcpServer, engine } = yield* self.buildMcpServer(sessionMeta, options.dbHandle); + const transport = yield* makeMcpWorkerTransport({ + sessionIdGenerator: () => self.sessionId, + storage: self.makeStorage(), + enableJsonResponse: options.enableJsonResponse, + }); + self.transportJsonResponseMode = options.enableJsonResponse ?? false; + yield* transport.connect(mcpServer); + return { mcpServer, transport, engine }; + }).pipe(Effect.withSpan("McpSessionDO.createRuntime")); + } + + private closeRuntime(): Effect.Effect { + const self = this; + return Effect.gen(function* () { + if (self.transport) { + yield* self.transport.close(); + self.transport = null; + } + if (self.mcpServer) { + const mcpServer = self.mcpServer; + // oxlint-disable-next-line executor/no-promise-catch -- boundary: MCP SDK close failure is ignored during best-effort runtime teardown + yield* Effect.promise(() => mcpServer.close().catch(() => undefined)); + self.mcpServer = null; + } + self.engine = null; + if (self.dbHandle) { + const dbHandle = self.dbHandle; + yield* Effect.promise(() => Promise.resolve(dbHandle.end())); + self.dbHandle = null; + } + self.initialized = false; + self.transportJsonResponseMode = null; + }).pipe( + // oxlint-disable-next-line executor/no-effect-escape-hatch -- boundary: DO cleanup has no typed failure surface + Effect.orDie, + ); + } + + private installRuntime( + sessionMeta: SessionMeta, + options: { + readonly dbHandle: TDbHandle; + readonly enableJsonResponse: boolean; + }, + ) { + const self = this; + return Effect.gen(function* () { + const runtime = yield* self.createConnectedRuntime(sessionMeta, options); + self.dbHandle = options.dbHandle; + self.mcpServer = runtime.mcpServer; + self.transport = runtime.transport; + self.engine = runtime.engine; + self.initialized = true; + }); + } + + private ensureRuntimeForApproval(): Effect.Effect { + const self = this; + return Effect.gen(function* () { + if (self.initialized && self.engine) return true; + + const sessionMeta = yield* self.loadSessionMeta(); + if (!sessionMeta) return false; + + yield* self.closeRuntime(); + const dbHandle = self.openSessionDb(); + yield* self.installRuntime(sessionMeta, { + dbHandle, + enableJsonResponse: true, + }); + yield* Effect.promise(() => self.markActivity()).pipe( + Effect.withSpan("McpSessionDO.markActivity"), + ); + return true; + }).pipe( + Effect.withSpan("McpSessionDO.ensure_runtime_for_approval"), + // oxlint-disable-next-line executor/no-effect-escape-hatch -- boundary: DO RPC has no typed Effect channel + Effect.orDie, + ); + } + + private validateApprovalIdentity( + identity: McpApprovalOwner, + ): Effect.Effect<"ok" | "not_found" | "forbidden"> { + const self = this; + return Effect.gen(function* () { + const sessionMeta = yield* self.loadSessionMeta(); + if (!sessionMeta) return "not_found" as const; + + const matches = + identity.accountId === sessionMeta.userId && + identity.organizationId === sessionMeta.organizationId; + + yield* Effect.annotateCurrentSpan({ + "mcp.session.owner_match": matches, + }); + + return matches ? ("ok" as const) : ("forbidden" as const); + }).pipe(Effect.withSpan("mcp.session.validate_approval_identity")); + } + + private restoreRuntimeFromStorage(request: Request): Effect.Effect<"restored" | "missing_meta"> { + const self = this; + return Effect.gen(function* () { + if (self.initialized && self.transport) return "restored" as const; + + const sessionMeta = yield* self.loadSessionMeta(); + if (!sessionMeta) { + yield* Effect.annotateCurrentSpan({ + "mcp.session.restore.outcome": "missing_meta", + }); + return "missing_meta" as const; + } + + yield* self.closeRuntime(); + const dbHandle = self.openSessionDb(); + yield* self.installRuntime(sessionMeta, { + dbHandle, + // GET always returns an SSE stream regardless of this option, but the + // session-scoped transport is reused by later POSTs. Keep JSON mode on + // across cold restores so a GET reconnect cannot poison future POSTs. + enableJsonResponse: true, + }); + yield* Effect.promise(() => self.markActivity()).pipe( + Effect.withSpan("McpSessionDO.markActivity"), + ); + yield* Effect.annotateCurrentSpan({ + "mcp.session.restore.outcome": "restored", + }); + return "restored" as const; + }).pipe( + Effect.withSpan("McpSessionDO.restoreRuntime", { + attributes: { + "mcp.request.method": request.method, + "mcp.request.session_id_present": !!request.headers.get("mcp-session-id"), + }, + }), + // oxlint-disable-next-line executor/no-effect-escape-hatch -- boundary: cold DO restore is re-entered from Promise-only Durable Object method + Effect.orDie, + ); + } + + private ensureJsonResponseTransportForPost(request: Request): Effect.Effect { + const self = this; + return Effect.gen(function* () { + if (request.method !== "POST" || self.transportJsonResponseMode === true) return; + + const sessionMeta = yield* self.loadSessionMeta(); + if (!sessionMeta) return; + + yield* self.closeRuntime(); + const dbHandle = self.openSessionDb(); + yield* self.installRuntime(sessionMeta, { + dbHandle, + enableJsonResponse: true, + }); + yield* Effect.annotateCurrentSpan({ + "mcp.session.transport_upgraded_json_response": true, + }); + }).pipe( + Effect.withSpan("McpSessionDO.ensureJsonResponseTransportForPost"), + // oxlint-disable-next-line executor/no-effect-escape-hatch -- boundary: transport rebuild is internal DO runtime state + Effect.orDie, + ); + } + + private validateSessionOwner(request: Request): Effect.Effect { + const self = this; + return Effect.gen(function* () { + const sessionMeta = yield* self.loadSessionMeta(); + if (!sessionMeta) return null; + + const accountId = request.headers.get(INTERNAL_ACCOUNT_ID_HEADER); + const organizationId = request.headers.get(INTERNAL_ORGANIZATION_ID_HEADER); + const matches = + accountId === sessionMeta.userId && organizationId === sessionMeta.organizationId; + + yield* Effect.annotateCurrentSpan({ + "mcp.session.owner_match": matches, + }); + + return matches ? null : sessionOwnerMismatch(); + }).pipe(Effect.withSpan("mcp.session.validate_owner")); + } + + private resolveAndStoreSessionMeta(token: McpSessionInit) { + const self = this; + return Effect.gen(function* () { + const sessionMeta = yield* self.resolveSessionMeta(token); + yield* Effect.promise(() => self.saveSessionMeta(sessionMeta)).pipe( + Effect.withSpan("mcp.session.save_meta"), + ); + return sessionMeta; + }).pipe(Effect.withSpan("mcp.session.resolve_and_store_meta")); + } + + async init(token: McpSessionInit, incoming?: IncomingTraceHeaders): Promise { + const methodEnteredAt = Date.now(); + if (this.initialized) return; + const self = this; + return Effect.runPromise( + Effect.gen(function* () { + yield* Effect.annotateCurrentSpan(self.entryAttrs(methodEnteredAt)); + yield* self.doInit(token); + }).pipe( + Effect.withSpan("McpSessionDO.init", { + attributes: { "mcp.auth.organization_id": token.organizationId }, + }), + (eff) => this.withTelemetry(eff, incoming), + // oxlint-disable-next-line executor/no-effect-escape-hatch -- boundary: Durable Object init method can only reject its Promise + Effect.orDie, + ), + ); + } + + private doInit(token: McpSessionInit) { + const self = this; + // Single Effect chain so every sub-span (resolveSessionMeta, + // createRuntime, createScopedExecutor, createExecutorMcpServer, + // transport.connect, storage.setAlarm) lands as a child of + // `McpSessionDO.init`. The prior implementation called + // `Effect.runPromise` nested inside an async function, which orphaned + // each sub-span into its own root trace and made init opaque — + // dashboard saw one 2.77s span with nothing under it. + return Effect.gen(function* () { + const sessionMeta = yield* self.resolveAndStoreSessionMeta(token); + + self.dbHandle = self.openSessionDb(); + // POST responses go out as JSON so `transport.handleRequest()` awaits + // every MCP tool callback before resolving — keeps engine spans inside + // the outer `handleRequest` Effect's fiber so `currentRequestSpan` is + // still set when the host-mcp `parentSpan` getter reads it. With SSE + // POSTs the callback fires after `Effect.ensuring` clears the field + // and engine spans orphan into new root traces. GET still streams + // (the GET handler doesn't consult `enableJsonResponse`). + const runtime = yield* self.createConnectedRuntime(sessionMeta, { + dbHandle: self.dbHandle, + enableJsonResponse: true, + }); + self.mcpServer = runtime.mcpServer; + self.transport = runtime.transport; + self.engine = runtime.engine; + + self.initialized = true; + yield* Effect.promise(() => self.markActivity()).pipe( + Effect.withSpan("McpSessionDO.markActivity"), + ); + }).pipe( + Effect.tapCause((cause) => + Effect.sync(() => { + console.error("[mcp-session] init failed:", cause); + }), + ), + Effect.catchCause((cause) => + Effect.gen(function* () { + yield* Effect.promise(() => self.cleanup()); + return yield* Effect.failCause(cause); + }), + ), + // oxlint-disable-next-line executor/no-effect-escape-hatch -- boundary: doInit is called only from Promise-only Durable Object init + Effect.orDie, + ); + } + + async handleRequest(request: Request): Promise { + const methodEnteredAt = Date.now(); + // Wrap the dispatch in an Effect span so every DO request — not just + // the rare new-session `init()` — shows up in Axiom. Basic attributes + // only (method, session-id presence, response status); rich client + // fingerprint stays on the edge `mcp.request` span, which shares a + // trace_id with this one. + const incoming = { + traceparent: request.headers.get("traceparent") ?? undefined, + tracestate: request.headers.get("tracestate") ?? undefined, + baggage: request.headers.get("baggage") ?? undefined, + } satisfies IncomingTraceHeaders; + const self = this; + const program = Effect.gen(function* () { + yield* Effect.annotateCurrentSpan(self.entryAttrs(methodEnteredAt)); + // Capture the request-entry span so the host-mcp `parentSpan` getter + // — fired by deferred MCP SDK callbacks after this Effect has already + // returned — anchors engine spans under the same trace. Cleared in a + // finalizer so a future request that arrives without a fresh span + // doesn't accidentally inherit a stale one. + const span = yield* Effect.currentSpan; + self.currentRequestSpan = span; + + return yield* self.dispatchRequest(request).pipe( + Effect.tap((response) => + Effect.annotateCurrentSpan({ + "mcp.response.status_code": response.status, + "mcp.response.content_type": response.headers.get("content-type") ?? "", + "mcp.transport.enable_json_response": self.transportJsonResponseMode ?? false, + }), + ), + Effect.ensuring( + Effect.sync(() => { + self.currentRequestSpan = null; + }), + ), + ); + }).pipe( + Effect.withSpan("McpSessionDO.handleRequest", { + attributes: { + "mcp.request.method": request.method, + "mcp.request.session_id_present": !!request.headers.get("mcp-session-id"), + }, + }), + (eff) => this.withTelemetry(eff, incoming), + ); + return Effect.runPromise(program); + } + + async getPausedExecutionForApproval( + executionId: string, + identity: McpApprovalOwner, + incoming?: IncomingTraceHeaders, + ): Promise { + const self = this; + return Effect.runPromise( + Effect.gen(function* () { + const owner = yield* self.validateApprovalIdentity(identity); + if (owner !== "ok") return { status: owner } as const; + + const restored = yield* self.ensureRuntimeForApproval(); + if (!restored || !self.engine) return { status: "not_found" } as const; + + const paused = yield* self.engine.getPausedExecution(executionId); + if (!paused) return { status: "not_found" } as const; + + const formatted = formatPausedExecution(paused); + return { + status: "ok" as const, + text: formatted.text, + structured: formatted.structured, + }; + }).pipe( + Effect.withSpan("McpSessionDO.getPausedExecutionForApproval", { + attributes: { "mcp.execution.id": executionId }, + }), + (eff) => this.withTelemetry(eff, incoming), + // oxlint-disable-next-line executor/no-effect-escape-hatch -- boundary: DO RPC exposes Promise results + Effect.orDie, + ), + ); + } + + private takeApprovalResponse(executionId: string): Effect.Effect { + const self = this; + return Effect.promise(async () => { + const memoryResponse = self.approvalResponses.get(executionId); + if (memoryResponse) { + self.approvalResponses.delete(executionId); + await self.ctx.storage.delete(approvalResponseKey(executionId)); + return memoryResponse; + } + const stored = await self.ctx.storage.get(approvalResponseKey(executionId)); + if (!stored) return null; + await self.ctx.storage.delete(approvalResponseKey(executionId)); + return stored; + }); + } + + private waitForApprovalResponse(executionId: string): Effect.Effect { + const self = this; + return Effect.gen(function* () { + const existing = yield* self.takeApprovalResponse(executionId); + if (existing) return existing; + + const waiter = + self.approvalWaiters.get(executionId) ?? (yield* Deferred.make()); + self.approvalWaiters.set(executionId, waiter); + yield* Deferred.await(waiter).pipe( + Effect.ensuring( + Effect.sync(() => { + if (self.approvalWaiters.get(executionId) === waiter) { + self.approvalWaiters.delete(executionId); + } + }), + ), + ); + return yield* self.takeApprovalResponse(executionId); + }); + } + + async resumeExecutionForApproval( + executionId: string, + identity: McpApprovalOwner, + response: ResumeResponse, + incoming?: IncomingTraceHeaders, + ): Promise { + const self = this; + return Effect.runPromise( + Effect.gen(function* () { + const owner = yield* self.validateApprovalIdentity(identity); + if (owner !== "ok") return { status: owner } as const; + + const restored = yield* self.ensureRuntimeForApproval(); + if (!restored || !self.engine) return { status: "not_found" } as const; + + const paused = yield* self.engine.getPausedExecution(executionId); + if (!paused) return { status: "not_found" } as const; + + self.approvalResponses.set(executionId, response); + yield* Effect.promise(() => + self.ctx.storage.put(approvalResponseKey(executionId), response), + ); + const waiter = self.approvalWaiters.get(executionId); + if (waiter) yield* Deferred.succeed(waiter, response); + return resumeApprovalResult(executionId, response); + }).pipe( + Effect.withSpan("McpSessionDO.resumeExecutionForApproval", { + attributes: { "mcp.execution.id": executionId }, + }), + (eff) => this.withTelemetry(eff, incoming), + // oxlint-disable-next-line executor/no-effect-escape-hatch -- boundary: DO RPC exposes Promise results + Effect.orDie, + ), + ); + } + + private dispatchRequest(request: Request): Effect.Effect { + const self = this; + return Effect.gen(function* () { + const ownerError = yield* self.validateSessionOwner(request); + if (ownerError) return ownerError; + return yield* self.dispatchAuthorizedRequest(request); + }); + } + + private dispatchAuthorizedRequest(request: Request): Effect.Effect { + if (!this.initialized || !this.transport) { + if (request.method === "DELETE") { + return this.clearSessionState().pipe( + Effect.as(new Response(null, { status: 204 })), + Effect.withSpan("mcp.session.stale_delete"), + ); + } + const self = this; + return Effect.gen(function* () { + const restored = yield* self.restoreRuntimeFromStorage(request); + if (restored === "restored") { + return yield* self.dispatchAuthorizedRequest(request); + } + return jsonRpcError(404, -32001, "Session timed out due to inactivity — please reconnect"); + }); + } + + const self = this; + return Effect.gen(function* () { + yield* self.ensureJsonResponseTransportForPost(request); + const transport = self.transport; + if (!transport) { + return jsonRpcError(404, -32001, "Session timed out due to inactivity — please reconnect"); + } + + yield* Effect.promise(() => self.markActivity()).pipe( + Effect.withSpan("McpSessionDO.markActivity"), + ); + const response = yield* transport.handleRequest(request).pipe( + Effect.withSpan("McpSessionDO.transport.handleRequest", { + attributes: { + "mcp.request.method": request.method, + "mcp.request.content_type": request.headers.get("content-type") ?? "", + "mcp.request.content_length": request.headers.get("content-length") ?? "", + }, + }), + ); + yield* Effect.annotateCurrentSpan({ + "mcp.response.status_code": response.status, + "mcp.response.content_type": response.headers.get("content-type") ?? "", + "mcp.transport.enable_json_response": self.transportJsonResponseMode ?? false, + }); + if (request.method === "DELETE") { + yield* Effect.promise(() => self.cleanup()).pipe(Effect.withSpan("mcp.session.cleanup")); + } + return response; + }).pipe( + Effect.catchCause((cause) => + Effect.sync(() => { + console.error("[mcp-session] handleRequest error:", Cause.pretty(cause)); + self.captureCause(cause); + return jsonRpcError(500, -32603, "Internal error"); + }), + ), + ); + } + + override async alarm(): Promise { + const program = Effect.promise(() => this.runAlarm()).pipe( + Effect.withSpan("McpSessionDO.alarm"), + (eff) => this.withTelemetry(eff), + ); + return Effect.runPromise(program); + } + + async clearSession(incoming?: IncomingTraceHeaders): Promise { + return Effect.runPromise( + Effect.promise(() => this.cleanup()).pipe( + Effect.withSpan("McpSessionDO.clearSession"), + (eff) => this.withTelemetry(eff, incoming), + ), + ); + } + + private async runAlarm(): Promise { + const lastActivityMs = await this.loadLastActivity(); + const idleMs = Date.now() - lastActivityMs; + if (idleMs >= SESSION_TIMEOUT_MS) { + await Effect.runPromise(this.closeRuntime()); + await this.ctx.storage.deleteAlarm(); + return; + } + await this.ctx.storage.setAlarm(Date.now() + HEARTBEAT_MS); + } + + private async cleanup(): Promise { + await Effect.runPromise(this.closeRuntime()); + await Effect.runPromise(this.clearSessionState()); + } +} From 47700af8ffa6e88694e2e9a6faae5ca8183bcea7 Mon Sep 17 00:00:00 2001 From: Rhys Sullivan Date: Sun, 31 May 2026 12:23:07 -0700 Subject: [PATCH 18/31] host-cloudflare: serve MCP through the shared session Durable Object Replaces the in-process MCP session store with the same Durable-Object-backed store cloud uses (@executor-js/cloudflare), so a session lives in one addressable isolate (DO id == session id). The in-memory map was invisible to the next Worker isolate, so tools/list after initialize failed in production ("Not connected"); the DO routes every follow-up request back to the same isolate. host-cloudflare binds the shared McpSessionDOBase to its own seams: a long-lived D1 handle, single-tenant session meta, and the QuickJS execution stack. Adds the MCP_SESSION binding + new_sqlite_classes migration, exports the DO at the worker entry, and asserts tools/list survives a fresh session in the workerd e2e. The base's openSessionDb seam is now async-tolerant for D1's schema bring-up. --- apps/host-cloudflare/package.json | 1 + apps/host-cloudflare/src/app.ts | 4 +- apps/host-cloudflare/src/config.ts | 6 +- apps/host-cloudflare/src/mcp/index.ts | 46 ++++------ .../src/mcp/session-durable-object.ts | 91 +++++++++++++++++++ apps/host-cloudflare/src/mcp/session-store.ts | 57 ++++++------ .../src/worker.e2e.node.test.ts | 43 +++++++++ apps/host-cloudflare/src/worker.ts | 4 + apps/host-cloudflare/wrangler.jsonc | 9 ++ bun.lock | 1 + .../src/mcp/session-durable-object.ts | 18 ++-- 11 files changed, 214 insertions(+), 66 deletions(-) create mode 100644 apps/host-cloudflare/src/mcp/session-durable-object.ts diff --git a/apps/host-cloudflare/package.json b/apps/host-cloudflare/package.json index 4247dae9f..05f3981fd 100644 --- a/apps/host-cloudflare/package.json +++ b/apps/host-cloudflare/package.json @@ -18,6 +18,7 @@ "@effect/atom-react": "catalog:", "@executor-js/api": "workspace:*", "@executor-js/app": "workspace:*", + "@executor-js/cloudflare": "workspace:*", "@executor-js/execution": "workspace:*", "@executor-js/host-mcp": "workspace:*", "@executor-js/plugin-encrypted-secrets": "workspace:*", diff --git a/apps/host-cloudflare/src/app.ts b/apps/host-cloudflare/src/app.ts index c98c23429..c59912bf8 100644 --- a/apps/host-cloudflare/src/app.ts +++ b/apps/host-cloudflare/src/app.ts @@ -43,7 +43,9 @@ export const makeCloudflareApp = async (env: CloudflareEnv) => { // per-request scoped executor reads through the DbProvider seam). const dbHandle = await createD1ExecutorDb(env.DB, env.BLOBS, plugins); const identityLayer = cloudflareAccessIdentityLayer(config); - const mcp = makeCloudflareMcpSeams(config, dbHandle); + // MCP runs through the `MCP_SESSION` Durable Object (cross-isolate sessions); + // each session DO opens its own D1 handle, so it takes `env`, not `dbHandle`. + const mcp = makeCloudflareMcpSeams(config, env); const { appLayer, toWebHandler } = ExecutorApp.make({ plugins, diff --git a/apps/host-cloudflare/src/config.ts b/apps/host-cloudflare/src/config.ts index 10294bac5..7fd03b7db 100644 --- a/apps/host-cloudflare/src/config.ts +++ b/apps/host-cloudflare/src/config.ts @@ -1,4 +1,4 @@ -import type { D1Database, R2Bucket } from "@cloudflare/workers-types"; +import type { D1Database, DurableObjectNamespace, R2Bucket } from "@cloudflare/workers-types"; // --------------------------------------------------------------------------- // Cloudflare host config. Unlike self-host (process.env + a data dir), a Worker @@ -16,6 +16,10 @@ export interface CloudflareEnv { readonly DB: D1Database; /** R2 bucket binding — holds values too large for a D1 row (~1-2MB cap). */ readonly BLOBS?: R2Bucket; + /** MCP session Durable Object namespace — one addressable isolate per MCP + * session (the DO id IS the session id), so a session survives across the + * Worker's stateless isolates. */ + readonly MCP_SESSION: DurableObjectNamespace; /** Zero Trust team domain, e.g. `your-team.cloudflareaccess.com`. */ readonly ACCESS_TEAM_DOMAIN: string; /** The Access application's AUD tag (the JWT audience to verify). */ diff --git a/apps/host-cloudflare/src/mcp/index.ts b/apps/host-cloudflare/src/mcp/index.ts index 39dadc36f..3b4f31156 100644 --- a/apps/host-cloudflare/src/mcp/index.ts +++ b/apps/host-cloudflare/src/mcp/index.ts @@ -1,22 +1,14 @@ import type { Layer } from "effect"; -import type { ExecutorDbHandle } from "@executor-js/api/server"; import type { McpAuthProvider, McpErrorReporter, McpSessionStore } from "@executor-js/host-mcp"; -import type { CloudflareConfig } from "../config"; +import type { CloudflareConfig, CloudflareEnv } from "../config"; import { cloudflareAccessMcpAuth } from "./auth"; -import { - cloudflareMcpReporter, - cloudflareMcpSessions, - makeCloudflareMcpSessionStore, -} from "./session-store"; +import { cloudflareMcpReporter, makeCloudflareMcpSessionStore } from "./session-store"; export { cloudflareAccessMcpAuth } from "./auth"; -export { - cloudflareMcpReporter, - cloudflareMcpSessions, - makeCloudflareMcpSessionStore, -} from "./session-store"; +export { cloudflareMcpReporter, makeCloudflareMcpSessionStore } from "./session-store"; +export { McpSessionDO } from "./session-durable-object"; // --------------------------------------------------------------------------- // The Cloudflare MCP serving seams, fed to `ExecutorApp.make`'s `mcp` group. @@ -27,8 +19,8 @@ export { // error-reporter override: // - McpAuthProvider -> `cloudflareAccessMcpAuth`: validate the Access JWT // (same identity as the API gate); no MCP OAuth. -// - McpSessionStore -> `cloudflareMcpSessions`: the shared in-process store -// over the QuickJS engine + long-lived D1 handle. +// - McpSessionStore -> the shared Durable-Object dispatcher over the host's +// `MCP_SESSION` namespace (cross-isolate, same as cloud). // - McpErrorReporter -> `cloudflareMcpReporter`: route 500 defects through the // host's console capture. // --------------------------------------------------------------------------- @@ -36,28 +28,22 @@ export { export interface CloudflareMcpSeams { /** Validate the Access JWT to an MCP `AuthOutcome`; declares no discovery routes. */ readonly auth: Layer.Layer; - /** The in-process session store seam (dispatch + lifetime). */ + /** The Durable-Object session store seam (dispatch + lifetime). */ readonly sessions: Layer.Layer; /** Route 500 defects through the host's console `ErrorCapture`. */ readonly reporter: Layer.Layer; - /** Dispose all live in-process MCP sessions at shutdown (not a seam). */ - readonly close: () => Promise; } /** - * Build the Cloudflare MCP serving seams over the long-lived D1 handle. Returns - * the three seam Layers plus the `close()` lifetime hook (no-op on Workers, - * where the isolate is torn down wholesale, but kept for parity with self-host). + * Build the Cloudflare MCP serving seams over the host's `MCP_SESSION` Durable + * Object namespace. No per-session DB handle is threaded here — each session DO + * opens its own D1 handle in its own isolate. */ export const makeCloudflareMcpSeams = ( config: CloudflareConfig, - dbHandle: ExecutorDbHandle, -): CloudflareMcpSeams => { - const sessionStore = makeCloudflareMcpSessionStore(config, dbHandle); - return { - auth: cloudflareAccessMcpAuth(config), - sessions: cloudflareMcpSessions(sessionStore), - reporter: cloudflareMcpReporter, - close: sessionStore.close, - }; -}; + env: CloudflareEnv, +): CloudflareMcpSeams => ({ + auth: cloudflareAccessMcpAuth(config), + sessions: makeCloudflareMcpSessionStore(env), + reporter: cloudflareMcpReporter, +}); diff --git a/apps/host-cloudflare/src/mcp/session-durable-object.ts b/apps/host-cloudflare/src/mcp/session-durable-object.ts new file mode 100644 index 000000000..372c7b9ac --- /dev/null +++ b/apps/host-cloudflare/src/mcp/session-durable-object.ts @@ -0,0 +1,91 @@ +import { Effect } from "effect"; + +import { createExecutorMcpServer } from "@executor-js/host-mcp/tool-server"; +import type { ExecutorDbHandle } from "@executor-js/api/server"; +import { + McpSessionDOBase, + type BuiltMcpServer, + type McpSessionInit, + type SessionMeta, +} from "@executor-js/cloudflare/mcp/durable-object"; + +import { loadConfig, type CloudflareConfig, type CloudflareEnv } from "../config"; +import { makeCloudflarePlugins, type CloudflarePlugins } from "../plugins"; +import { createD1ExecutorDb } from "../db/d1"; +import { makeCloudflareExecutionStackLayer, makeExecutionStack } from "../execution"; +import { preloadQuickJs } from "../quickjs"; + +// --------------------------------------------------------------------------- +// Cloudflare (self-host) MCP Session Durable Object — the host-cloudflare +// binding of the shared `McpSessionDOBase` (@executor-js/cloudflare). Identical +// base to cloud; the ONLY differences are the injected dependencies: +// - openSessionDb → a long-lived D1 `ExecutorDbHandle` (same FumaDB +// assembly the HTTP path uses), adapted to the base's +// `end` disposal contract. +// - resolveSessionMeta → single-tenant: the org is fixed in config, so no +// lookup — just stamp the configured org name. +// - buildMcpServer → the QuickJS execution stack + the MCP tool server. +// host-cf has no OTel/Sentry, so it keeps the base's default no-op telemetry + +// error seams. Replacing the prior in-memory store with this DO is what fixes +// `tools/list` failing across Worker isolates (a session created on one isolate +// was invisible to the next; the DO id == session id routes them all back). +// --------------------------------------------------------------------------- + +// The long-lived D1 handle, adapted to the base's `end` contract. D1 owns its +// own lifecycle (the binding is the connection), so `end` is `close` — a no-op. +type CfSessionDbHandle = ExecutorDbHandle & { readonly end: () => Promise }; + +export class McpSessionDO extends McpSessionDOBase { + private readonly cfEnv: CloudflareEnv; + private readonly cfConfig: CloudflareConfig; + private readonly cfPlugins: CloudflarePlugins; + + // `ctx`'s type is taken from the base constructor so it tracks whichever + // `@cloudflare/workers-types` the shared package resolves (avoids a + // cross-version `DurableObjectState` mismatch at the `super` call). + constructor(ctx: ConstructorParameters[0], env: CloudflareEnv) { + super(ctx, env); + this.cfEnv = env; + this.cfConfig = loadConfig(env); + this.cfPlugins = makeCloudflarePlugins(this.cfConfig.secretKey); + } + + protected override async openSessionDb(): Promise { + const handle = await createD1ExecutorDb(this.cfEnv.DB, this.cfEnv.BLOBS, this.cfPlugins); + return { ...handle, end: () => handle.close() }; + } + + protected override resolveSessionMeta(token: McpSessionInit): Effect.Effect { + // Single-tenant: every Access principal belongs to the one configured org, + // so there is nothing to resolve — stamp the configured org name. + return Effect.succeed({ + organizationId: token.organizationId, + organizationName: this.cfConfig.organizationName, + userId: token.userId, + elicitationMode: token.elicitationMode, + } satisfies SessionMeta); + } + + protected override buildMcpServer( + sessionMeta: SessionMeta, + dbHandle: CfSessionDbHandle, + ): Effect.Effect { + const config = this.cfConfig; + return Effect.gen(function* () { + // QuickJS-WASM must be loaded before the executor layer builds it (the + // default variant can't fetch its .wasm on Workers). Idempotent per isolate. + yield* Effect.promise(() => preloadQuickJs()); + const { engine } = yield* makeExecutionStack( + sessionMeta.userId, + sessionMeta.organizationId, + sessionMeta.organizationName, + ).pipe(Effect.provide(makeCloudflareExecutionStackLayer(config, dbHandle))); + const mcpServer = yield* createExecutorMcpServer({ engine }); + return { mcpServer, engine } satisfies BuiltMcpServer; + }).pipe( + Effect.withSpan("McpSessionDO.buildMcpServer"), + // oxlint-disable-next-line executor/no-effect-escape-hatch -- boundary: a runtime-build failure surfaces as the base's tapCause/cleanup defect + Effect.orDie, + ); + } +} diff --git a/apps/host-cloudflare/src/mcp/session-store.ts b/apps/host-cloudflare/src/mcp/session-store.ts index a1944d025..cb4a8b114 100644 --- a/apps/host-cloudflare/src/mcp/session-store.ts +++ b/apps/host-cloudflare/src/mcp/session-store.ts @@ -1,41 +1,42 @@ import { Layer } from "effect"; +import { makeConsoleMcpErrorReporter } from "@executor-js/api/server"; +import type { McpErrorReporter, McpSessionStore } from "@executor-js/host-mcp"; import { - makeConsoleMcpErrorReporter, - makeMcpBuildServer, - type ExecutorDbHandle, -} from "@executor-js/api/server"; -import type { McpErrorReporter } from "@executor-js/host-mcp"; -import { - inMemoryMcpSessionsLayer, - makeInMemoryMcpSessionStore, - type InMemoryMcpSessionStore, -} from "@executor-js/host-mcp/in-memory-session-store"; + makeDurableObjectMcpSessionStore, + type McpSessionDOStub, +} from "@executor-js/cloudflare/mcp/session-store"; -import type { CloudflareConfig } from "../config"; -import { makeCloudflareExecutionStackLayer } from "../execution"; +import type { CloudflareEnv } from "../config"; import { ErrorCaptureLive } from "../observability"; // --------------------------------------------------------------------------- -// Cloudflare McpSessionStore wiring — the SAME shared seam as self-host. The -// store body, the per-session engine builder (`makeMcpBuildServer`), and the -// console error reporter (`makeConsoleMcpErrorReporter`) all live in shared -// code; the Cloudflare host supplies only its fully-provided execution-stack -// layer (QuickJS over the long-lived D1 handle). The cross-isolate variant is -// cloud's Durable Object store behind this same `McpSessionStore` seam. +// Cloudflare McpSessionStore wiring — the SAME shared Durable-Object dispatcher +// as cloud (@executor-js/cloudflare), over host-cloudflare's `MCP_SESSION` +// namespace. The dispatch/identity/trace/peek logic all lives in the shared +// package; the host supplies ONLY its DO stub accessors (the session id IS the +// DO id, so every follow-up request routes back to the same isolate). +// +// This replaces the in-process store: an in-memory session map is invisible to +// the next Worker isolate, so `tools/list` after `initialize` failed in +// production ("Not connected"). The DO holds the session in one addressable +// isolate, fixing that across the board. // --------------------------------------------------------------------------- -/** Build the in-process MCP session store over the long-lived D1 handle. */ -export const makeCloudflareMcpSessionStore = ( - config: CloudflareConfig, - dbHandle: ExecutorDbHandle, -): InMemoryMcpSessionStore => - makeInMemoryMcpSessionStore( - makeMcpBuildServer(makeCloudflareExecutionStackLayer(config, dbHandle)), - ); +// The DO RPC stub structurally satisfies `McpSessionDOStub` (init/handleRequest/ +// clearSession), but `@cloudflare/workers-types` types it as a generic +// `DurableObjectStub`. Narrow at this one boundary via an `unknown` hop — a +// single cast, so no double-cast through the worker-types stub type. +const toSessionStub = (stub: unknown): McpSessionDOStub => stub as McpSessionDOStub; -/** The `McpSessionStore` envelope seam over a freshly built in-process store. */ -export const cloudflareMcpSessions = inMemoryMcpSessionsLayer; +/** Build the DO-backed MCP session store over the host's `MCP_SESSION` namespace. */ +export const makeCloudflareMcpSessionStore = (env: CloudflareEnv): Layer.Layer => + makeDurableObjectMcpSessionStore({ + getStub: (sessionId) => + toSessionStub(env.MCP_SESSION.get(env.MCP_SESSION.idFromString(sessionId))), + newStub: () => toSessionStub(env.MCP_SESSION.get(env.MCP_SESSION.newUniqueId())), + // host-cf has no Sentry; a 500-defect surfaces through the reporter seam below. + }); /** Route 500-defects through the host's console `ErrorCapture`. */ export const cloudflareMcpReporter: Layer.Layer = diff --git a/apps/host-cloudflare/src/worker.e2e.node.test.ts b/apps/host-cloudflare/src/worker.e2e.node.test.ts index 10bf550ca..427f91ea9 100644 --- a/apps/host-cloudflare/src/worker.e2e.node.test.ts +++ b/apps/host-cloudflare/src/worker.e2e.node.test.ts @@ -128,6 +128,49 @@ describe("cloudflare host e2e (workerd/miniflare)", () => { expect(res.status).toBe(200); }); + it("lists tools on a follow-up request after a fresh initialize (DO session survives across requests)", async () => { + // The production regression: `initialize` creates the session, then a + // SEPARATE `tools/list` request must find it. With the old in-process store a + // second Worker isolate never saw the session and this returned "Not + // connected"; the MCP-session Durable Object (id == session id) routes the + // follow-up back to the same isolate, so the tool list comes through. + const accept = "application/json, text/event-stream"; + const rpc = (sessionId: string | null, body: unknown) => + worker.fetch("/mcp", { + method: "POST", + headers: { + "content-type": "application/json", + accept, + ...(sessionId ? { "mcp-session-id": sessionId } : {}), + }, + body: JSON.stringify(body), + }); + + const init = await rpc(null, { + jsonrpc: "2.0", + id: 1, + method: "initialize", + params: { + protocolVersion: "2025-03-26", + capabilities: {}, + clientInfo: { name: "test", version: "1" }, + }, + }); + expect(init.status).toBe(200); + const sessionId = init.headers.get("mcp-session-id"); + expect(sessionId).toBeTruthy(); + + await rpc(sessionId, { jsonrpc: "2.0", method: "notifications/initialized" }); + + const list = await rpc(sessionId, { jsonrpc: "2.0", id: 2, method: "tools/list" }); + expect(list.status).toBe(200); + const listed = (await list.json()) as { + result?: { tools?: ReadonlyArray<{ name: string }> }; + }; + const toolNames = listed.result?.tools?.map((t) => t.name) ?? []; + expect(toolNames).toContain("execute"); + }, 60_000); + it("invokes the execute tool over MCP (initialize → tools/call → QuickJS)", async () => { const accept = "application/json, text/event-stream"; const rpc = (sessionId: string | null, body: unknown) => diff --git a/apps/host-cloudflare/src/worker.ts b/apps/host-cloudflare/src/worker.ts index 5b1cbb926..228b60a55 100644 --- a/apps/host-cloudflare/src/worker.ts +++ b/apps/host-cloudflare/src/worker.ts @@ -1,6 +1,10 @@ import { makeCloudflareApp } from "./app"; import type { CloudflareEnv } from "./config"; +// The MCP session Durable Object class, bound as `MCP_SESSION` in wrangler.jsonc. +// Must be exported at the Worker entry module scope for the runtime to find it. +export { McpSessionDO } from "./mcp"; + // --------------------------------------------------------------------------- // The Worker fetch entry. `ExecutorApp.make`'s `toWebHandler()` produces a // `(Request) => Promise` — exactly a Worker handler — so the entry is diff --git a/apps/host-cloudflare/wrangler.jsonc b/apps/host-cloudflare/wrangler.jsonc index 1c191c5f4..f9f2febe6 100644 --- a/apps/host-cloudflare/wrangler.jsonc +++ b/apps/host-cloudflare/wrangler.jsonc @@ -34,6 +34,15 @@ "bucket_name": "executor-blobs", }, ], + // The MCP session Durable Object: one addressable isolate per MCP session (the + // DO id IS the session id) so a session survives across the Worker's stateless + // isolates — without it, `tools/list` after `initialize` can land on a fresh + // isolate that never saw the session ("Not connected"). `new_sqlite_classes` + // is the free-tier-eligible SQLite-backed DO storage. + "durable_objects": { + "bindings": [{ "name": "MCP_SESSION", "class_name": "McpSessionDO" }], + }, + "migrations": [{ "tag": "v1", "new_sqlite_classes": ["McpSessionDO"] }], // Cloudflare Access is the entire auth layer: the Worker validates the // Cf-Access-Jwt-Assertion JWT against the team JWKS. Set these to your Zero // Trust team domain + the Access application's AUD tag. EXECUTOR_SECRET_KEY diff --git a/bun.lock b/bun.lock index 0cf55f0e6..6621e6723 100644 --- a/bun.lock +++ b/bun.lock @@ -158,6 +158,7 @@ "@effect/atom-react": "catalog:", "@executor-js/api": "workspace:*", "@executor-js/app": "workspace:*", + "@executor-js/cloudflare": "workspace:*", "@executor-js/execution": "workspace:*", "@executor-js/host-mcp": "workspace:*", "@executor-js/plugin-encrypted-secrets": "workspace:*", diff --git a/packages/hosts/cloudflare/src/mcp/session-durable-object.ts b/packages/hosts/cloudflare/src/mcp/session-durable-object.ts index aca490ee8..16c43d11f 100644 --- a/packages/hosts/cloudflare/src/mcp/session-durable-object.ts +++ b/packages/hosts/cloudflare/src/mcp/session-durable-object.ts @@ -188,8 +188,14 @@ export abstract class McpSessionDOBase< // ------------------------------------------------------------------------- /** Open the per-session DB handle the runtime holds for this session's - * lifetime (postgres.js for cloud, the D1 handle for host-cloudflare). */ - protected abstract openSessionDb(): TDbHandle; + * lifetime (postgres.js for cloud, the D1 handle for host-cloudflare). May be + * async — host-cloudflare runs an idempotent schema bring-up when it opens. */ + protected abstract openSessionDb(): TDbHandle | Promise; + + /** Resolve `openSessionDb` (sync or async) into the Effect chain. */ + private openSessionDbHandle(): Effect.Effect { + return Effect.promise(() => Promise.resolve(this.openSessionDb())); + } /** Resolve + validate the session owner into the meta persisted to storage. * Owns its own short-lived DB/services (it runs once per session create). */ @@ -379,7 +385,7 @@ export abstract class McpSessionDOBase< if (!sessionMeta) return false; yield* self.closeRuntime(); - const dbHandle = self.openSessionDb(); + const dbHandle = yield* self.openSessionDbHandle(); yield* self.installRuntime(sessionMeta, { dbHandle, enableJsonResponse: true, @@ -429,7 +435,7 @@ export abstract class McpSessionDOBase< } yield* self.closeRuntime(); - const dbHandle = self.openSessionDb(); + const dbHandle = yield* self.openSessionDbHandle(); yield* self.installRuntime(sessionMeta, { dbHandle, // GET always returns an SSE stream regardless of this option, but the @@ -465,7 +471,7 @@ export abstract class McpSessionDOBase< if (!sessionMeta) return; yield* self.closeRuntime(); - const dbHandle = self.openSessionDb(); + const dbHandle = yield* self.openSessionDbHandle(); yield* self.installRuntime(sessionMeta, { dbHandle, enableJsonResponse: true, @@ -541,7 +547,7 @@ export abstract class McpSessionDOBase< return Effect.gen(function* () { const sessionMeta = yield* self.resolveAndStoreSessionMeta(token); - self.dbHandle = self.openSessionDb(); + self.dbHandle = yield* self.openSessionDbHandle(); // POST responses go out as JSON so `transport.handleRequest()` awaits // every MCP tool callback before resolving — keeps engine spans inside // the outer `handleRequest` Effect's fiber so `currentRequestSpan` is From f58fbc68d4a1dcc729ad060fe4469bc38d5808b2 Mon Sep 17 00:00:00 2001 From: Rhys Sullivan Date: Sun, 31 May 2026 12:25:10 -0700 Subject: [PATCH 19/31] Narrow the DO stub cast through a single unknown hop Both Cloudflare hosts cast `env.MCP_SESSION.get()` to the McpSessionDOStub RPC surface. Route it through an `unknown`-param helper so it is a single cast (no double cast through worker-types' DurableObjectStub), dropping the lint suppressions and the formatter-fragile disable comments. --- apps/cloud/src/mcp/session-store.ts | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-) diff --git a/apps/cloud/src/mcp/session-store.ts b/apps/cloud/src/mcp/session-store.ts index 53ddfd2d0..d3c4e33c5 100644 --- a/apps/cloud/src/mcp/session-store.ts +++ b/apps/cloud/src/mcp/session-store.ts @@ -21,11 +21,15 @@ class McpInternalJsonRpcError extends Data.TaggedError("McpInternalJsonRpcError" readonly message: string; }> {} +// The DO RPC stub structurally satisfies `McpSessionDOStub` (init/handleRequest/ +// clearSession), but `@cloudflare/workers-types` types it as a generic +// `DurableObjectStub`. Narrow at this one boundary via an `unknown` hop — a +// single cast, so no double-cast through the worker-types stub type. +const toSessionStub = (stub: unknown): McpSessionDOStub => stub as McpSessionDOStub; + export const cloudMcpSessionStoreLayer = makeDurableObjectMcpSessionStore({ - // oxlint-disable-next-line executor/no-double-cast -- boundary: the DO RPC stub structurally satisfies McpSessionDOStub getStub: (sessionId) => - env.MCP_SESSION.get(env.MCP_SESSION.idFromString(sessionId)) as unknown as McpSessionDOStub, - // oxlint-disable-next-line executor/no-double-cast -- boundary: the DO RPC stub structurally satisfies McpSessionDOStub - newStub: () => env.MCP_SESSION.get(env.MCP_SESSION.newUniqueId()) as unknown as McpSessionDOStub, + toSessionStub(env.MCP_SESSION.get(env.MCP_SESSION.idFromString(sessionId))), + newStub: () => toSessionStub(env.MCP_SESSION.get(env.MCP_SESSION.newUniqueId())), onInternalError: (message) => Sentry.captureException(new McpInternalJsonRpcError({ message })), }); From 28985f17efa57ef43857cd2eafa0041c92741dd4 Mon Sep 17 00:00:00 2001 From: Rhys Sullivan Date: Sun, 31 May 2026 13:17:37 -0700 Subject: [PATCH 20/31] Derive the web base URL from the request when none is configured Hosts that can't know their public URL at boot (a Worker has no static URL var) no longer need to hardcode it. New optional RequestWebOrigin seam carries the request's real origin; makeScopedExecutor resolves the effective webBaseUrl as configured-value-then-request-origin, read via Effect.serviceOption so it never enters the executor's R channel (CLI/tests just fall through). The shared execution-stack middleware provides it per HTTP request; the MCP session DO threads the create request's origin through McpSessionInit -> SessionMeta and the base provides it around buildMcpServer. We read request.url, not a spoofable X-Forwarded-Host, so the OAuth-callback URL stays trustworthy. host-cloudflare drops its hardcoded https://localhost default and the wrangler VITE_PUBLIC_SITE_URL placeholder, so a fresh self-host deploy gets correct secret/OAuth handoff links with zero config; setting the var still overrides. --- apps/host-cloudflare/src/config.ts | 8 +++-- apps/host-cloudflare/wrangler.jsonc | 5 ++- bun.lock | 1 + packages/core/api/src/server.ts | 2 ++ .../src/server/execution-stack-middleware.ts | 11 ++++-- .../core/api/src/server/scoped-executor.ts | 36 +++++++++++++++++-- packages/core/sdk/src/executor.ts | 7 +++- packages/hosts/cloudflare/package.json | 1 + packages/hosts/cloudflare/src/mcp/seams.ts | 3 ++ .../src/mcp/session-durable-object.ts | 19 ++++++++-- .../hosts/cloudflare/src/mcp/session-store.ts | 4 +++ 11 files changed, 86 insertions(+), 11 deletions(-) diff --git a/apps/host-cloudflare/src/config.ts b/apps/host-cloudflare/src/config.ts index 7fd03b7db..ffb04847c 100644 --- a/apps/host-cloudflare/src/config.ts +++ b/apps/host-cloudflare/src/config.ts @@ -56,7 +56,9 @@ export interface CloudflareConfig { readonly organizationName: string; readonly secretKey: string; readonly allowLocalNetwork: boolean; - readonly webBaseUrl: string; + /** Explicit web base URL (`VITE_PUBLIC_SITE_URL`). Unset on a Worker with no + * static URL — the per-request origin is used instead (see RequestWebOrigin). */ + readonly webBaseUrl?: string; readonly enableDevAuth: boolean; } @@ -84,7 +86,9 @@ export const loadConfig = (env: CloudflareEnv): CloudflareConfig => { organizationName: env.SELF_HOSTED_ORG_NAME ?? "Default", secretKey, allowLocalNetwork: env.ALLOW_LOCAL_NETWORK === "true", - webBaseUrl: env.VITE_PUBLIC_SITE_URL ?? "https://localhost", + // No static URL on a Worker — leave unset when VITE_PUBLIC_SITE_URL is absent + // and let the request origin drive it (RequestWebOrigin). Explicit still wins. + webBaseUrl: env.VITE_PUBLIC_SITE_URL, enableDevAuth: env.ENABLE_DEV_AUTH === "true", }; }; diff --git a/apps/host-cloudflare/wrangler.jsonc b/apps/host-cloudflare/wrangler.jsonc index f9f2febe6..4e9aba169 100644 --- a/apps/host-cloudflare/wrangler.jsonc +++ b/apps/host-cloudflare/wrangler.jsonc @@ -56,6 +56,9 @@ "ADMIN_EMAILS": "", "SELF_HOSTED_ORG_ID": "default", "SELF_HOSTED_ORG_NAME": "Default", - "VITE_PUBLIC_SITE_URL": "https://localhost", + // VITE_PUBLIC_SITE_URL is intentionally unset: with no static URL the worker + // derives the web base URL from each request's origin (RequestWebOrigin), so + // secret/OAuth handoff links match whatever host the user actually reached. + // Set it only to force a canonical URL (e.g. behind a proxy that rewrites Host). }, } diff --git a/bun.lock b/bun.lock index 6621e6723..7035ba10c 100644 --- a/bun.lock +++ b/bun.lock @@ -578,6 +578,7 @@ "name": "@executor-js/cloudflare", "version": "0.0.0", "dependencies": { + "@executor-js/api": "workspace:*", "@executor-js/execution": "workspace:*", "@executor-js/host-mcp": "workspace:*", "@modelcontextprotocol/sdk": "^1.29.0", diff --git a/packages/core/api/src/server.ts b/packages/core/api/src/server.ts index 24b22a76d..52d5f9b49 100644 --- a/packages/core/api/src/server.ts +++ b/packages/core/api/src/server.ts @@ -53,8 +53,10 @@ export { makeScopedExecutor, HostConfig, PluginsProvider, + RequestWebOrigin, type HostConfigShape, type PluginsProviderShape, + type RequestWebOriginShape, } from "./server/scoped-executor"; export { collectTables } from "@executor-js/sdk"; export { diff --git a/packages/core/api/src/server/execution-stack-middleware.ts b/packages/core/api/src/server/execution-stack-middleware.ts index 4173433f7..2c86ce7c6 100644 --- a/packages/core/api/src/server/execution-stack-middleware.ts +++ b/packages/core/api/src/server/execution-stack-middleware.ts @@ -40,7 +40,7 @@ import { Context, Effect, Layer } from "effect"; import type { AnyPlugin } from "@executor-js/sdk"; import type { DbProvider } from "./executor-fuma-db"; -import type { HostConfig, PluginsProvider } from "./scoped-executor"; +import { RequestWebOrigin, type HostConfig, type PluginsProvider } from "./scoped-executor"; import { ExecutionEngineService, ExecutorService } from "../services"; import { providePluginExtensions, type PluginExtensionServices } from "../plugin-routes"; import { @@ -165,11 +165,18 @@ export const makeExecutionStackMiddleware = < // The strategy recovered the failure into a Response — return it. if (!isPrincipal(resolved)) return resolved; const auth = AuthContext.of(authContextFromPrincipal(resolved)); + // The public origin the caller actually hit, so a host with no static + // web base URL (a Worker) derives one zero-config. An explicit + // `HostConfig.webBaseUrl` still wins; we deliberately read `request.url` + // (not a spoofable `X-Forwarded-Host`). const { executor, engine } = yield* makeExecutionStack( resolved.accountId, resolved.organizationId, resolved.organizationName, - ).pipe(Effect.provide(options.stackLayer)); + ).pipe( + Effect.provide(options.stackLayer), + Effect.provideService(RequestWebOrigin, { origin: new URL(webRequest.url).origin }), + ); return yield* httpEffect.pipe( Effect.provideService(AuthContext, auth), Effect.provideService(ExecutorService, executor), diff --git a/packages/core/api/src/server/scoped-executor.ts b/packages/core/api/src/server/scoped-executor.ts index 74e59d90e..5440a5368 100644 --- a/packages/core/api/src/server/scoped-executor.ts +++ b/packages/core/api/src/server/scoped-executor.ts @@ -26,7 +26,7 @@ // stay in the SDK and are imported from there. // --------------------------------------------------------------------------- -import { Context, Effect } from "effect"; +import { Context, Effect, Option } from "effect"; import { createExecutor, @@ -53,14 +53,36 @@ export interface HostConfigShape { /** * Base URL of the executor's web UI. Threaded into `coreTools.webBaseUrl` so * `secrets.create` can point the user at `${webBaseUrl}/secrets?...`. + * + * Optional: when a host can't know its public URL at boot (a Worker has no + * static URL var), leave it unset and `makeScopedExecutor` falls back to the + * current request's origin (`RequestWebOrigin`). An explicit value always wins. */ - readonly webBaseUrl: string; + readonly webBaseUrl?: string; } export class HostConfig extends Context.Service()( "@executor-js/sdk/HostConfig", ) {} +// --------------------------------------------------------------------------- +// RequestWebOrigin seam — the public origin of the in-flight request +// (`https://host[:port]`), used to derive `webBaseUrl` when no explicit one is +// configured. Provided per request by the host's request pipeline (the shared +// `makeExecutionStackMiddleware` for the HTTP API; the session DO for MCP). +// Read OPTIONALLY via `Effect.serviceOption`, so it never enters +// `makeScopedExecutor`'s `R` channel — non-request callers (CLI, tests) simply +// fall through to the configured value. +// --------------------------------------------------------------------------- + +export interface RequestWebOriginShape { + readonly origin: string; +} + +export class RequestWebOrigin extends Context.Service()( + "@executor-js/api/RequestWebOrigin", +) {} + // --------------------------------------------------------------------------- // PluginsProvider seam — the per-host (and possibly per-request) plugin array. // @@ -108,6 +130,14 @@ export const makeScopedExecutor = < const { db } = yield* DbProvider; const { plugins: pluginsFactory } = yield* PluginsProvider; const config = yield* HostConfig; + // Explicit config wins; otherwise fall back to the request origin if a host + // provided one (HTTP middleware / MCP session DO). Stays `undefined` for + // non-request callers — `coreTools.webBaseUrl` is optional and only the + // browser-handoff tools require it (they fail clearly if it's truly absent). + const requestOrigin = yield* Effect.serviceOption(RequestWebOrigin); + const webBaseUrl = + config.webBaseUrl ?? + Option.match(requestOrigin, { onNone: () => undefined, onSome: (o) => o.origin }); const plugins = pluginsFactory(); const httpClientLayer = makeHostedHttpClientLayer({ @@ -125,7 +155,7 @@ export const makeScopedExecutor = < httpClientLayer, onElicitation: "accept-all", coreTools: { - webBaseUrl: config.webBaseUrl, + webBaseUrl, }, }); // The seam erases the plugin tuple type; the caller re-narrows via the diff --git a/packages/core/sdk/src/executor.ts b/packages/core/sdk/src/executor.ts index 81102bd77..071bb0e20 100644 --- a/packages/core/sdk/src/executor.ts +++ b/packages/core/sdk/src/executor.ts @@ -423,9 +423,14 @@ export interface ExecutorConfig self.sessionId, storage: self.makeStorage(), @@ -508,7 +517,13 @@ export abstract class McpSessionDOBase< private resolveAndStoreSessionMeta(token: McpSessionInit) { const self = this; return Effect.gen(function* () { - const sessionMeta = yield* self.resolveSessionMeta(token); + const resolved = yield* self.resolveSessionMeta(token); + // Carry the create request's origin onto the persisted meta (the host's + // resolveSessionMeta is identity-only and doesn't see it), so a cold + // isolate rebuilds the runtime with the same web base URL. + const sessionMeta: SessionMeta = token.webOrigin + ? { ...resolved, webOrigin: token.webOrigin } + : resolved; yield* Effect.promise(() => self.saveSessionMeta(sessionMeta)).pipe( Effect.withSpan("mcp.session.save_meta"), ); diff --git a/packages/hosts/cloudflare/src/mcp/session-store.ts b/packages/hosts/cloudflare/src/mcp/session-store.ts index 1ec69723a..c2f29f8ac 100644 --- a/packages/hosts/cloudflare/src/mcp/session-store.ts +++ b/packages/hosts/cloudflare/src/mcp/session-store.ts @@ -97,6 +97,10 @@ const createSession = ( organizationId: token.organizationId, userId: token.accountId, elicitationMode: readElicitationMode(request), + // The public origin the client reached us at — lets the DO derive a web + // base URL with no static config (we read the real URL, not a spoofable + // forwarded host). + webOrigin: new URL(request.url).origin, }, propagation, ), From fe379bf1c9de6fd86a02c3fa0c775bfce6b8f12c Mon Sep 17 00:00:00 2001 From: Rhys Sullivan Date: Sun, 31 May 2026 14:39:27 -0700 Subject: [PATCH 21/31] Stop tracking self-host dev runtime (secret.key + dev SQLite DB) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The unify commit committed apps/host-selfhost/.executor-dev/ — the per-app dev runtime dir holding a generated secret.key and the local dev SQLite DB. The gitignore only covered apps/local/.executor-dev/. Untrack it and replace the app-specific rule with a global .executor-dev/ so no host commits dev state. --- .gitignore | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/.gitignore b/.gitignore index 3d826ac00..f34fc003a 100644 --- a/.gitignore +++ b/.gitignore @@ -45,7 +45,8 @@ personal-notes/ *.har.executor executor.har .executor/ -apps/local/.executor-dev/ +# Per-app dev runtime dirs (local SQLite DB + generated dev secret.key) — never commit +.executor-dev/ # desktop app build artifacts apps/desktop/resources/ From 5f445cb233a4b5f35e2e31bbb42b69648fb4e9d1 Mon Sep 17 00:00:00 2001 From: Rhys Sullivan Date: Sun, 31 May 2026 15:31:16 -0700 Subject: [PATCH 22/31] Route /extensions/* to the app handler (fixes billing UI 404s) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The refactor mounts the Autumn billing proxy at /extensions/billing/route/* and Swagger UI at /extensions/docs, but start.ts's dispatch only forwarded /api/* and MCP paths to the app handler — so every authenticated billing call (the React app posts to /extensions/billing/route/* via ) and /extensions/docs fell through to TanStack Start and 404'd. Extract the app-owned path decision into ./app-paths (isAppOwnedPath) so it is unit-testable without building the whole app, add /extensions/* to it, and add a regression test pinning every app-owned surface (incl. the billing proxy + docs) and the Start-owned routes. Caught by review; no test covered the dispatch. --- apps/cloud/src/app-paths.test.ts | 38 ++++++++++++++++++++++++++++++++ apps/cloud/src/app-paths.ts | 25 +++++++++++++++++++++ apps/cloud/src/start.ts | 23 +++++++++---------- 3 files changed, 73 insertions(+), 13 deletions(-) create mode 100644 apps/cloud/src/app-paths.test.ts create mode 100644 apps/cloud/src/app-paths.ts diff --git a/apps/cloud/src/app-paths.test.ts b/apps/cloud/src/app-paths.test.ts new file mode 100644 index 000000000..f773ddcce --- /dev/null +++ b/apps/cloud/src/app-paths.test.ts @@ -0,0 +1,38 @@ +import { describe, expect, it } from "@effect/vitest"; + +import { isAppOwnedPath } from "./app-paths"; + +// Guards the start.ts dispatch decision: every surface the unified app handler +// serves must be classified app-owned (forwarded to `app.handler`), and Start's +// own routes must NOT be. The `/extensions/*` cases are the regression: the +// React app posts billing calls to `/extensions/billing/route/*` and Swagger +// lives at `/extensions/docs`; both 404 if the dispatcher drops `/extensions/*`. +describe("isAppOwnedPath", () => { + const appOwned = [ + "/api", + "/api/executions", + "/api/auth/me", + "/api/openapi.json", + "/extensions/billing/route/customer", // AutumnProvider pathPrefix — the billing UI + "/extensions/billing/route/attach", + "/extensions/docs", // Swagger UI + "/mcp", + "/.well-known/oauth-protected-resource/mcp", + "/.well-known/oauth-authorization-server", + ]; + for (const pathname of appOwned) { + it(`forwards ${pathname} to the app handler`, () => { + expect(isAppOwnedPath(pathname)).toBe(true); + }); + } + + // Start-owned: the React shell + its routes. Note `/billing` (the React page) + // is distinct from `/extensions/billing/route/*` (the proxy) — only the latter + // is app-owned. + const startOwned = ["/", "/policies", "/login", "/billing", "/org", "/assets/app.js"]; + for (const pathname of startOwned) { + it(`leaves ${pathname} to the Start router`, () => { + expect(isAppOwnedPath(pathname)).toBe(false); + }); + } +}); diff --git a/apps/cloud/src/app-paths.ts b/apps/cloud/src/app-paths.ts new file mode 100644 index 000000000..b2430cf49 --- /dev/null +++ b/apps/cloud/src/app-paths.ts @@ -0,0 +1,25 @@ +import { classifyMcpPath } from "./mcp/mount"; + +// --------------------------------------------------------------------------- +// Single source of truth for "does the unified app handler own this path?" — +// the decision `start.ts` makes per request (app handler vs TanStack Start). +// +// The app handler (`ExecutorApp.make`'s `toWebHandler`) serves three surfaces at +// their real paths, so the dispatcher must forward all of them UNMODIFIED: +// - `/api` + `/api/*` — the `/api`-prefixed typed API +// - `/extensions/*` — Swagger UI (`/extensions/docs`) + the Autumn +// billing proxy (`/extensions/billing/route/*`) +// - `/mcp` + `/.well-known/*` — the MCP serving envelope + OAuth discovery +// +// Anything else falls through to the Start router. Missing `/extensions/*` here +// 404s the entire authenticated billing UI (the React app posts to +// `/extensions/billing/route/*` via ``), which is why it has a +// dedicated test. +// --------------------------------------------------------------------------- + +export const isApiPath = (pathname: string) => pathname === "/api" || pathname.startsWith("/api/"); + +export const isExtensionPath = (pathname: string) => pathname.startsWith("/extensions/"); + +export const isAppOwnedPath = (pathname: string) => + isApiPath(pathname) || isExtensionPath(pathname) || classifyMcpPath(pathname) !== null; diff --git a/apps/cloud/src/start.ts b/apps/cloud/src/start.ts index ddf6ed0df..7ca7c0cf2 100644 --- a/apps/cloud/src/start.ts +++ b/apps/cloud/src/start.ts @@ -1,30 +1,27 @@ import { createMiddleware, createStart } from "@tanstack/react-start"; import { cloudApiHandler } from "./app"; +import { isAppOwnedPath } from "./app-paths"; import { marketingMiddleware, posthogProxyMiddleware, sentryTunnelMiddleware } from "./edge"; -import { classifyMcpPath } from "./mcp/mount"; // --------------------------------------------------------------------------- // The unified app web handler — `ExecutorApp.make`'s `toWebHandler` (app.ts). // It serves EVERY app-owned path in one Effect HTTP layer: the `/api`-prefixed -// typed API (the protected plugin API + account + org + docs + autumn) AND the -// `/mcp` serving envelope + its `/.well-known/*` OAuth discovery docs — exactly -// like self-host's single `toWebHandler`. start.ts no longer hand-routes those -// surfaces; it only decides app-owned-vs-Start and forwards unmodified. +// typed API (the protected plugin API + account + org), the cloud `/extensions/*` +// routes (Swagger docs + the Autumn billing proxy), AND the `/mcp` serving +// envelope + its `/.well-known/*` OAuth discovery docs — exactly like self-host's +// single `toWebHandler`. start.ts no longer hand-routes those surfaces; it only +// decides app-owned-vs-Start and forwards unmodified. // --------------------------------------------------------------------------- const app = cloudApiHandler(); -// app-owned = the `/api`-prefixed API OR an MCP/OAuth-discovery path. The app -// handler serves these at their real paths (`mountPrefix: "/api"` mounts the -// typed API under `/api`; the MCP envelope mounts `/mcp` + the two discovery -// docs at root), so we forward the request UNMODIFIED — no path stripping. -const isApiPath = (pathname: string) => pathname === "/api" || pathname.startsWith("/api/"); -const isAppOwned = (pathname: string) => isApiPath(pathname) || classifyMcpPath(pathname) !== null; - +// app-owned = the `/api`-prefixed API, an `/extensions/*` route, OR an +// MCP/OAuth-discovery path (see `./app-paths`). The app handler serves these at +// their real paths, so we forward the request UNMODIFIED — no path stripping. const appRequestMiddleware = createMiddleware({ type: "request" }).server( ({ pathname, request, next }) => { - if (isAppOwned(pathname)) return app.handler(request); + if (isAppOwnedPath(pathname)) return app.handler(request); return next(); }, ); From d9251aea7a01e902c39d46b74aa93b2d085e32b7 Mon Sep 17 00:00:00 2001 From: Rhys Sullivan Date: Sun, 31 May 2026 16:00:19 -0700 Subject: [PATCH 23/31] Add realistic reachability smoke test for the composed cloud handler MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Boots the actual cloudApiHandler (ExecutorApp.make's toWebHandler — the handler start.ts forwards to) in the workers pool and drives it with raw Requests, asserting each served surface is REACHED, not 404'd into the SPA fallback: the Autumn billing proxy (401 JSON, the exact regression), Swagger UI, the OpenAPI spec, and the protected /api auth gate. This is the integration complement to app-paths.test.ts, which guards the start.ts dispatch decision. Together they cover both halves of the billing-404 class: does start.ts forward /extensions/*, and does the handler serve it. Runs in the workers pool because the composed app imports agents/mcp (workerd only); the asserted surfaces short-circuit before any WorkOS/Autumn network. --- .../cloud/src/extensions-reachability.test.ts | 73 +++++++++++++++++++ 1 file changed, 73 insertions(+) create mode 100644 apps/cloud/src/extensions-reachability.test.ts diff --git a/apps/cloud/src/extensions-reachability.test.ts b/apps/cloud/src/extensions-reachability.test.ts new file mode 100644 index 000000000..2e13060d3 --- /dev/null +++ b/apps/cloud/src/extensions-reachability.test.ts @@ -0,0 +1,73 @@ +// --------------------------------------------------------------------------- +// Realistic reachability smoke test for the composed cloud handler. +// +// Boots the ACTUAL `cloudApiHandler` — `ExecutorApp.make`'s `toWebHandler`, the +// exact handler `start.ts` forwards app-owned requests to — and drives it with +// raw `Request`s to prove every served surface is REACHED, not dropped into a +// 404 / the SPA fallback. This is the integration complement to +// `app-paths.test.ts` (which guards the `start.ts` dispatch decision): together +// they cover both halves of the billing-404 class — +// - app-paths.test.ts: "does start.ts forward /extensions/* to the handler?" +// - this file: "does the handler actually serve /extensions/* ?" +// +// It catches a route being dropped from `makeCloudExtensionRoutes`, the Autumn +// proxy / Swagger being unmounted, the `/api` prefix wiring regressing, etc. +// +// Runs in the workers pool (real workerd) because the composed app transitively +// imports `agents/mcp` (the MCP envelope), which is workerd-only. The asserted +// surfaces short-circuit before any real network I/O: the billing proxy 401s +// before calling Autumn, the protected API 401/403s at the auth gate, and the +// spec / Swagger / discovery docs are static. +// --------------------------------------------------------------------------- + +import { describe, expect, it } from "@effect/vitest"; + +import { cloudApiHandler } from "./app"; + +const handler = cloudApiHandler().handler; + +const call = (method: string, path: string, init: RequestInit = {}) => + handler(new Request(`http://test.local${path}`, { method, ...init })); + +describe("cloud composed-handler reachability", () => { + it("serves the Autumn billing proxy (401 JSON, NOT a 404 SPA fallback)", async () => { + const res = await call("POST", "/extensions/billing/route/customer", { + headers: { "content-type": "application/json" }, + body: "{}", + }); + // The regression returned the TanStack SPA fallback (200 text/html). The real + // handler reaches the billing route and rejects the unauthenticated call. + expect(res.status).toBe(401); + expect(res.headers.get("content-type")).toContain("application/json"); + expect(await res.json()).toEqual({ error: "Unauthorized", code: "unauthorized" }); + }); + + it("serves Swagger UI at /extensions/docs", async () => { + const res = await call("GET", "/extensions/docs"); + expect(res.status).toBe(200); + expect(res.headers.get("content-type")).toContain("text/html"); + expect((await res.text()).toLowerCase()).toContain("swagger"); + }); + + it("serves the OpenAPI spec at /api/openapi.json", async () => { + const res = await call("GET", "/api/openapi.json"); + expect(res.status).toBe(200); + expect(res.headers.get("content-type")).toContain("application/json"); + const spec = (await res.json()) as { paths?: Record }; + expect(spec.paths).toBeDefined(); + // The spec is prefixed with /api, so a real route like scope is present. + expect(Object.keys(spec.paths ?? {}).some((p) => p.includes("/scope"))).toBe(true); + }); + + it("reaches the protected API auth gate at /api/scope (error JSON, NOT SPA HTML)", async () => { + const res = await call("GET", "/api/scope"); + expect([401, 403]).toContain(res.status); + expect(res.headers.get("content-type")).toContain("application/json"); + expect(await res.json()).toHaveProperty("code"); + }); + + // (The MCP envelope + its /.well-known/* discovery docs are exercised by the + // mcp-flow / mcp-miniflare suites; the dispatch half is pinned in + // app-paths.test.ts. They proxy to WorkOS, unreachable from this isolate, so + // they are not re-asserted here.) +}); From 19e189a9a11017cb5da603d3c41c01b291c00933 Mon Sep 17 00:00:00 2001 From: Rhys Sullivan Date: Sun, 31 May 2026 20:17:03 -0700 Subject: [PATCH 24/31] Serve cloud extension routes under /api, not a /extensions namespace MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The refactor mounted the Autumn billing proxy at /extensions/billing/route/* and Swagger at /extensions/docs — leaking the internal 'extensions' DI-seam name into the public URL, churning the stable /api/autumn + /api/docs paths, and creating a new top-level dispatch namespace (the source of the billing-404). Keep the extensions.routes SEAM (host-specific routes injected via ExecutorApp.make) but serve them under /api like everything else: - /extensions/billing/route/* -> /api/billing/* (also drops the 'autumn' vendor name) - /extensions/docs -> /api/docs AutumnProvider pathPrefix follows; the legacy CloudDocsLive paths are aligned. This deletes the /extensions dispatch special-case entirely — start.ts/app-paths go back to /api + MCP, so the unreachable-surface class can't recur. The file comment already documented the intent ('all serve UNDER the /api prefix'); the /extensions paths had contradicted it. Verified: cloud 78 workers + 106 node, reachability test confirms /api/billing/* coexists with the /api-prefixed typed router (401 JSON, not 404). --- apps/cloud/src/app-paths.test.ts | 15 ++++++------- apps/cloud/src/app-paths.ts | 22 +++++++------------ apps/cloud/src/app.ts | 6 ++--- .../cloud/src/extensions-reachability.test.ts | 10 ++++----- apps/cloud/src/extensions/billing/route.ts | 4 ++-- apps/cloud/src/extensions/docs.ts | 4 ++-- apps/cloud/src/extensions/routes.ts | 7 +++--- apps/cloud/src/routes/__root.tsx | 2 +- apps/cloud/src/start.ts | 15 +++++++------ 9 files changed, 40 insertions(+), 45 deletions(-) diff --git a/apps/cloud/src/app-paths.test.ts b/apps/cloud/src/app-paths.test.ts index f773ddcce..5b76d2fb9 100644 --- a/apps/cloud/src/app-paths.test.ts +++ b/apps/cloud/src/app-paths.test.ts @@ -4,18 +4,18 @@ import { isAppOwnedPath } from "./app-paths"; // Guards the start.ts dispatch decision: every surface the unified app handler // serves must be classified app-owned (forwarded to `app.handler`), and Start's -// own routes must NOT be. The `/extensions/*` cases are the regression: the -// React app posts billing calls to `/extensions/billing/route/*` and Swagger -// lives at `/extensions/docs`; both 404 if the dispatcher drops `/extensions/*`. +// own routes must NOT be. The billing proxy + Swagger live under `/api` +// (`/api/billing/*`, `/api/docs`) — the React app posts to `/api/billing/*` via +// — so a request there must reach the handler, not the SPA. describe("isAppOwnedPath", () => { const appOwned = [ "/api", "/api/executions", "/api/auth/me", "/api/openapi.json", - "/extensions/billing/route/customer", // AutumnProvider pathPrefix — the billing UI - "/extensions/billing/route/attach", - "/extensions/docs", // Swagger UI + "/api/billing/customer", // AutumnProvider pathPrefix — the billing UI + "/api/billing/attach", + "/api/docs", // Swagger UI "/mcp", "/.well-known/oauth-protected-resource/mcp", "/.well-known/oauth-authorization-server", @@ -27,8 +27,7 @@ describe("isAppOwnedPath", () => { } // Start-owned: the React shell + its routes. Note `/billing` (the React page) - // is distinct from `/extensions/billing/route/*` (the proxy) — only the latter - // is app-owned. + // is distinct from `/api/billing/*` (the proxy) — only the latter is app-owned. const startOwned = ["/", "/policies", "/login", "/billing", "/org", "/assets/app.js"]; for (const pathname of startOwned) { it(`leaves ${pathname} to the Start router`, () => { diff --git a/apps/cloud/src/app-paths.ts b/apps/cloud/src/app-paths.ts index b2430cf49..6dd6fc56f 100644 --- a/apps/cloud/src/app-paths.ts +++ b/apps/cloud/src/app-paths.ts @@ -4,22 +4,16 @@ import { classifyMcpPath } from "./mcp/mount"; // Single source of truth for "does the unified app handler own this path?" — // the decision `start.ts` makes per request (app handler vs TanStack Start). // -// The app handler (`ExecutorApp.make`'s `toWebHandler`) serves three surfaces at -// their real paths, so the dispatcher must forward all of them UNMODIFIED: -// - `/api` + `/api/*` — the `/api`-prefixed typed API -// - `/extensions/*` — Swagger UI (`/extensions/docs`) + the Autumn -// billing proxy (`/extensions/billing/route/*`) -// - `/mcp` + `/.well-known/*` — the MCP serving envelope + OAuth discovery -// -// Anything else falls through to the Start router. Missing `/extensions/*` here -// 404s the entire authenticated billing UI (the React app posts to -// `/extensions/billing/route/*` via ``), which is why it has a -// dedicated test. +// The app handler (`ExecutorApp.make`'s `toWebHandler`) serves everything under +// `/api/*` — the typed API plus the cloud `extensions.routes` (the Autumn billing +// proxy at `/api/billing/*` and Swagger at `/api/docs` both live under `/api`) — +// plus the `/mcp` serving envelope and its `/.well-known/*` OAuth discovery docs. +// The dispatcher forwards those UNMODIFIED; anything else falls through to the +// Start router. Keeping every served route under `/api` (no separate top-level +// namespace) is what keeps this gate a simple two-prefix check. // --------------------------------------------------------------------------- export const isApiPath = (pathname: string) => pathname === "/api" || pathname.startsWith("/api/"); -export const isExtensionPath = (pathname: string) => pathname.startsWith("/extensions/"); - export const isAppOwnedPath = (pathname: string) => - isApiPath(pathname) || isExtensionPath(pathname) || classifyMcpPath(pathname) !== null; + isApiPath(pathname) || classifyMcpPath(pathname) !== null; diff --git a/apps/cloud/src/app.ts b/apps/cloud/src/app.ts index 9f0230702..0ef70417e 100644 --- a/apps/cloud/src/app.ts +++ b/apps/cloud/src/app.ts @@ -32,7 +32,7 @@ import { WorkerTelemetryLive } from "./observability/telemetry"; // the Cloudflare dynamic-worker code substrate, MCP served by a Durable-Object // session store (the DO surfaced via `config.mcpExport`), console+Sentry error // capture — and Autumn BILLING entering ONLY as extensions: the engine -// metering decorator, the account seat-gate, the `/extensions/billing/route/*` proxy route, +// metering decorator, the account seat-gate, the `/api/billing/*` proxy route, // and the createOrganization free-limit gate. `diff` against // `apps/host-selfhost/src/app.ts` is the entire product difference. // @@ -134,6 +134,6 @@ export { McpSessionDO }; export const CloudAppLayer = appLayer; export const cloudMcpExport = mcpExport; -// The unified cloud web handler: serves /api/*, /api/auth/*, /mcp, -// /.well-known/*, /extensions/docs — everything the worker dispatches. +// The unified cloud web handler: serves /api/* (incl. /api/billing/*, /api/docs), +// /mcp, /.well-known/* — everything the worker dispatches. export const cloudApiHandler = toWebHandler; diff --git a/apps/cloud/src/extensions-reachability.test.ts b/apps/cloud/src/extensions-reachability.test.ts index 2e13060d3..43ab6d47f 100644 --- a/apps/cloud/src/extensions-reachability.test.ts +++ b/apps/cloud/src/extensions-reachability.test.ts @@ -7,8 +7,8 @@ // 404 / the SPA fallback. This is the integration complement to // `app-paths.test.ts` (which guards the `start.ts` dispatch decision): together // they cover both halves of the billing-404 class — -// - app-paths.test.ts: "does start.ts forward /extensions/* to the handler?" -// - this file: "does the handler actually serve /extensions/* ?" +// - app-paths.test.ts: "does start.ts forward the /api surface to the handler?" +// - this file: "does the handler actually serve billing + docs?" // // It catches a route being dropped from `makeCloudExtensionRoutes`, the Autumn // proxy / Swagger being unmounted, the `/api` prefix wiring regressing, etc. @@ -31,7 +31,7 @@ const call = (method: string, path: string, init: RequestInit = {}) => describe("cloud composed-handler reachability", () => { it("serves the Autumn billing proxy (401 JSON, NOT a 404 SPA fallback)", async () => { - const res = await call("POST", "/extensions/billing/route/customer", { + const res = await call("POST", "/api/billing/customer", { headers: { "content-type": "application/json" }, body: "{}", }); @@ -42,8 +42,8 @@ describe("cloud composed-handler reachability", () => { expect(await res.json()).toEqual({ error: "Unauthorized", code: "unauthorized" }); }); - it("serves Swagger UI at /extensions/docs", async () => { - const res = await call("GET", "/extensions/docs"); + it("serves Swagger UI at /api/docs", async () => { + const res = await call("GET", "/api/docs"); expect(res.status).toBe(200); expect(res.headers.get("content-type")).toContain("text/html"); expect((await res.text()).toLowerCase()).toContain("swagger"); diff --git a/apps/cloud/src/extensions/billing/route.ts b/apps/cloud/src/extensions/billing/route.ts index 53a3c2db5..bf8809df1 100644 --- a/apps/cloud/src/extensions/billing/route.ts +++ b/apps/cloud/src/extensions/billing/route.ts @@ -58,7 +58,7 @@ const handler = Effect.gen(function* () { clientOptions: { secretKey: env.AUTUMN_SECRET_KEY ?? "", }, - pathPrefix: "/extensions/billing/route", + pathPrefix: "/api/billing", }), ); @@ -81,4 +81,4 @@ const handler = Effect.gen(function* () { }), ); -export const AutumnRoutesLive = HttpRouter.add("*", "/extensions/billing/route/*", handler); +export const AutumnRoutesLive = HttpRouter.add("*", "/api/billing/*", handler); diff --git a/apps/cloud/src/extensions/docs.ts b/apps/cloud/src/extensions/docs.ts index 3500b5100..6106d4933 100644 --- a/apps/cloud/src/extensions/docs.ts +++ b/apps/cloud/src/extensions/docs.ts @@ -13,11 +13,11 @@ const spec = OpenApi.fromApi(CloudOpenApi); export const CloudOpenApiJsonLive = HttpRouter.add( "GET", - "/openapi.json", + "/api/openapi.json", Effect.succeed(HttpServerResponse.jsonUnsafe(spec)), ); export const CloudDocsLive = Layer.mergeAll( - HttpApiSwagger.layer(CloudOpenApi, { path: "/docs" }), + HttpApiSwagger.layer(CloudOpenApi, { path: "/api/docs" }), CloudOpenApiJsonLive, ); diff --git a/apps/cloud/src/extensions/routes.ts b/apps/cloud/src/extensions/routes.ts index 8bb7b0979..b60f66c9c 100644 --- a/apps/cloud/src/extensions/routes.ts +++ b/apps/cloud/src/extensions/routes.ts @@ -7,7 +7,8 @@ // switch-organization / invitations / MCP-approval) — `NonProtectedApi`. // - the cloud-only WorkOS domain-verification routes — `OrgHttpApi`. // - Swagger UI + the OpenAPI JSON for the full cloud spec. -// - the Autumn billing proxy (`/extensions/billing/route/*`) — billing-as-extension. +// - the Autumn billing proxy (`/api/billing/*`) — billing-as-extension (the +// `extensions.routes` SEAM, but served under `/api` like everything else). // - the global request-failure logging middleware. // // They all serve UNDER the `/api` prefix (the same namespace the protected + @@ -87,10 +88,10 @@ export const makeCloudExtensionRoutes = (rsLive: Layer.Layer + } showDialog={false}> } onHandledError={captureFrontendError}> diff --git a/apps/cloud/src/start.ts b/apps/cloud/src/start.ts index 7ca7c0cf2..b82c651fd 100644 --- a/apps/cloud/src/start.ts +++ b/apps/cloud/src/start.ts @@ -6,17 +6,18 @@ import { marketingMiddleware, posthogProxyMiddleware, sentryTunnelMiddleware } f // --------------------------------------------------------------------------- // The unified app web handler — `ExecutorApp.make`'s `toWebHandler` (app.ts). -// It serves EVERY app-owned path in one Effect HTTP layer: the `/api`-prefixed -// typed API (the protected plugin API + account + org), the cloud `/extensions/*` -// routes (Swagger docs + the Autumn billing proxy), AND the `/mcp` serving -// envelope + its `/.well-known/*` OAuth discovery docs — exactly like self-host's -// single `toWebHandler`. start.ts no longer hand-routes those surfaces; it only -// decides app-owned-vs-Start and forwards unmodified. +// It serves EVERY app-owned path in one Effect HTTP layer: everything under +// `/api/*` (the protected plugin API + account + org, plus the cloud +// `extensions.routes` — Swagger at `/api/docs`, the Autumn billing proxy at +// `/api/billing/*`), AND the `/mcp` serving envelope + its `/.well-known/*` +// OAuth discovery docs — exactly like self-host's single `toWebHandler`. +// start.ts no longer hand-routes those surfaces; it only decides +// app-owned-vs-Start and forwards unmodified. // --------------------------------------------------------------------------- const app = cloudApiHandler(); -// app-owned = the `/api`-prefixed API, an `/extensions/*` route, OR an +// app-owned = anything under `/api/*` (incl. the cloud extension routes) OR an // MCP/OAuth-discovery path (see `./app-paths`). The app handler serves these at // their real paths, so we forward the request UNMODIFIED — no path stripping. const appRequestMiddleware = createMiddleware({ type: "request" }).server( From 75bf01e540837f061fc2ea487af37b890383c72a Mon Sep 17 00:00:00 2001 From: Rhys Sullivan Date: Sun, 31 May 2026 23:00:34 -0700 Subject: [PATCH 25/31] Fix CI: cloud client bundle, embedded-migrations path, host-cf e2e assets - cloud: instantiate the unified app handler lazily inside the .server() callback so TanStack Start strips it (and ./app -> telemetry -> cloudflare:workers) from the CLIENT bundle. A module-top-level cloudApiHandler() leaked the workerd-only cloudflare:workers virtual module into the browser build and broke it. - cli + desktop: point the embedded-drizzle-migrations generators at src/db/embedded-migrations.gen.ts (the post-move location the runtime imports), not the deleted src/server/ path which ENOENT'd in CI. - local: update drizzle.config schema path to src/db/executor-schema.ts. - host-cloudflare e2e: ensure a minimal ./dist exists before unstable_dev so its assets-dir validation passes on a fresh CI checkout (no vite build). --- apps/cli/src/build.ts | 2 +- apps/cloud/src/start.ts | 14 ++++++++++++-- apps/desktop/scripts/build-sidecar.ts | 2 +- apps/host-cloudflare/src/worker.e2e.node.test.ts | 12 ++++++++++++ apps/local/drizzle.config.ts | 2 +- 5 files changed, 27 insertions(+), 5 deletions(-) diff --git a/apps/cli/src/build.ts b/apps/cli/src/build.ts index 0fca65ef9..8aa007624 100644 --- a/apps/cli/src/build.ts +++ b/apps/cli/src/build.ts @@ -251,7 +251,7 @@ const buildBinaries = async (targets: Target[], mode: BuildMode) => { const meta = await readMetadata(); const binaries: Record = {}; const embeddedWebUIPath = join(cliRoot, "src/embedded-web-ui.gen.ts"); - const embeddedMigrationsPath = join(webRoot, "src/server/embedded-migrations.gen.ts"); + const embeddedMigrationsPath = join(webRoot, "src/db/embedded-migrations.gen.ts"); await rm(distDir, { recursive: true, force: true }); diff --git a/apps/cloud/src/start.ts b/apps/cloud/src/start.ts index b82c651fd..03aa6f873 100644 --- a/apps/cloud/src/start.ts +++ b/apps/cloud/src/start.ts @@ -15,14 +15,24 @@ import { marketingMiddleware, posthogProxyMiddleware, sentryTunnelMiddleware } f // app-owned-vs-Start and forwards unmodified. // --------------------------------------------------------------------------- -const app = cloudApiHandler(); +// Instantiate the unified app handler LAZILY, on the first server request that +// needs it. This is load-bearing for the CLIENT bundle: TanStack Start bundles +// `start.ts` into the browser build but strips `.server()` callback *bodies*, so +// any symbol referenced only inside a server callback is tree-shaken out of the +// client. A module-top-level `cloudApiHandler()` would instead survive that +// stripping and drag `./app` → `observability/telemetry` → `cloudflare:workers` +// (a workerd-only virtual module) into the browser build, breaking it. Keeping +// the call inside the server callback mirrors how every other server concern +// here stays server-only. +let app: ReturnType | undefined; +const getApp = () => (app ??= cloudApiHandler()); // app-owned = anything under `/api/*` (incl. the cloud extension routes) OR an // MCP/OAuth-discovery path (see `./app-paths`). The app handler serves these at // their real paths, so we forward the request UNMODIFIED — no path stripping. const appRequestMiddleware = createMiddleware({ type: "request" }).server( ({ pathname, request, next }) => { - if (isAppOwnedPath(pathname)) return app.handler(request); + if (isAppOwnedPath(pathname)) return getApp().handler(request); return next(); }, ); diff --git a/apps/desktop/scripts/build-sidecar.ts b/apps/desktop/scripts/build-sidecar.ts index b167e508c..27fd460e9 100644 --- a/apps/desktop/scripts/build-sidecar.ts +++ b/apps/desktop/scripts/build-sidecar.ts @@ -23,7 +23,7 @@ const SIDECAR_ENTRY = resolve(ROOT, "src/sidecar/server.ts"); const SIDECAR_OUT_DIR = resolve(ROOT, "resources/sidecar"); const WEB_UI_OUT_DIR = resolve(ROOT, "resources/web-ui"); const APPS_LOCAL_DIST = resolve(APPS_LOCAL, "dist"); -const EMBEDDED_MIGRATIONS_PATH = resolve(APPS_LOCAL, "src/server/embedded-migrations.gen.ts"); +const EMBEDDED_MIGRATIONS_PATH = resolve(APPS_LOCAL, "src/db/embedded-migrations.gen.ts"); const EMBEDDED_MIGRATIONS_STUB = `const migrations: Record | null = null;\n\nexport default migrations;\n`; /** diff --git a/apps/host-cloudflare/src/worker.e2e.node.test.ts b/apps/host-cloudflare/src/worker.e2e.node.test.ts index 427f91ea9..3c7d63402 100644 --- a/apps/host-cloudflare/src/worker.e2e.node.test.ts +++ b/apps/host-cloudflare/src/worker.e2e.node.test.ts @@ -1,3 +1,4 @@ +import { existsSync, mkdirSync, writeFileSync } from "node:fs"; import { resolve } from "node:path"; import { fileURLToPath } from "node:url"; @@ -28,6 +29,17 @@ describe("cloudflare host e2e (workerd/miniflare)", () => { let worker: Unstable_DevWorker; beforeAll(async () => { + // CI runs from a fresh checkout with no `vite build`, so `./dist` (the SPA + // assets dir wrangler.jsonc points `assets.directory` at) is absent and + // `unstable_dev`'s assets validation aborts boot. This e2e drives the + // API/MCP surface (all `run_worker_first` paths), not the SPA, so a minimal + // placeholder index.html satisfies the validation without a real build. + const distIndex = resolve(dir, "../dist/index.html"); + if (!existsSync(distIndex)) { + mkdirSync(resolve(dir, "../dist"), { recursive: true }); + writeFileSync(distIndex, "executor"); + } + worker = await unstable_dev(resolve(dir, "worker.ts"), { config: resolve(dir, "../wrangler.jsonc"), ip: "127.0.0.1", diff --git a/apps/local/drizzle.config.ts b/apps/local/drizzle.config.ts index 8eff64606..7c284204b 100644 --- a/apps/local/drizzle.config.ts +++ b/apps/local/drizzle.config.ts @@ -1,7 +1,7 @@ import { defineConfig } from "drizzle-kit"; export default defineConfig({ - schema: "./src/server/executor-schema.ts", + schema: "./src/db/executor-schema.ts", out: "./drizzle", dialect: "sqlite", }); From 47b341c8a9a380b62b064b6ba8884701c7a2cf4a Mon Sep 17 00:00:00 2001 From: Rhys Sullivan Date: Sun, 31 May 2026 23:24:51 -0700 Subject: [PATCH 26/31] Fix preview binary: bundle libSQL native into the compiled CLI The local server's SQLite driver moved from bun:sqlite to libSQL, whose native addon `@libsql/` isn't bundled by `bun build --compile` (same bunfs limitation as @napi-rs/keyring), so the compiled binary's smoke test (`executor --version`) crashed with "Cannot find module '@libsql/'". This was masked until the embedded-migrations path fix let the build reach the smoke test. - build.ts: copy the platform `@libsql//index.node` next to the executable as `libsql.node` (mirrors the keyring.node colocation). - patch libsql@0.5.29 so its loader honors EXECUTOR_LIBSQL_NATIVE_PATH and loads the colocated binding directly (bun resolves the bare `require('@libsql/')` natively, bypassing any JS resolver hook). - native-bindings.ts: a side-effect module imported FIRST in main.ts that publishes the env var before the @executor-js/local -> libSQL graph loads it eagerly (ESM evaluates imports before the importer body, so setting it in main.ts's body ran too late). keyring colocation moved here too. Verified locally: build:preview:tarball smoke test passes; the binary opens the local store without the native-module crash. --- apps/cli/src/build.ts | 46 +++++++++++++++++++++++++++++++++ apps/cli/src/main.ts | 22 +++------------- apps/cli/src/native-bindings.ts | 45 ++++++++++++++++++++++++++++++++ bun.lock | 1 + package.json | 3 ++- patches/libsql@0.5.29.patch | 19 ++++++++++++++ 6 files changed, 117 insertions(+), 19 deletions(-) create mode 100644 apps/cli/src/native-bindings.ts create mode 100644 patches/libsql@0.5.29.patch diff --git a/apps/cli/src/build.ts b/apps/cli/src/build.ts index 8aa007624..f1c7fd511 100644 --- a/apps/cli/src/build.ts +++ b/apps/cli/src/build.ts @@ -161,6 +161,45 @@ const resolveKeyringNative = (t: Target): string | null => { } }; +/** + * Resolve the platform-specific `@libsql/` native binding for a target. + * + * The local server's SQLite driver (libSQL) loads its `.node` via a dynamic + * `require('@libsql/')`, which `bun build --compile` can't bundle into + * bunfs (same limitation as keyring). We copy the right `.node` next to the + * executor as `libsql.node`; main.ts redirects the bare require to it. + */ +const LIBSQL_NATIVE_VERSION = "0.5.29"; +const resolveLibsqlNative = (t: Target): string | null => { + const platformMap: Record = { + "darwin-arm64": "darwin-arm64", + "darwin-x64": "darwin-x64", + // The compiled binary runs on Bun, which libSQL's loader treats as glibc + // (its musl->gnu workaround), so non-musl linux targets need the -gnu binding. + "linux-arm64": "linux-arm64-gnu", + "linux-x64": "linux-x64-gnu", + "linux-arm64-musl": "linux-arm64-musl", + "linux-x64-musl": "linux-x64-musl", + "win32-arm64": "win32-arm64-msvc", + "win32-x64": "win32-x64-msvc", + }; + const key = [t.os, t.arch, t.abi].filter(Boolean).join("-"); + const target = platformMap[key]; + if (!target) return null; + const pkg = `@libsql/${target}`; + try { + const req = createRequire(join(repoRoot, "apps/local", "package.json")); + const pkgJson = req.resolve(`${pkg}/package.json`); + return join(dirname(pkgJson), "index.node"); + } catch { + const bunPath = join( + repoRoot, + `node_modules/.bun/${pkg.replace("/", "+")}@${LIBSQL_NATIVE_VERSION}/node_modules/${pkg}/index.node`, + ); + return existsSync(bunPath) ? bunPath : null; + } +}; + // --------------------------------------------------------------------------- // Build mode // --------------------------------------------------------------------------- @@ -310,6 +349,13 @@ const buildBinaries = async (targets: Target[], mode: BuildMode) => { await cp(keyringNative, join(binDir, "keyring.node")); } + // Copy the libSQL native binding next to executor — same bunfs limitation + // as keyring; main.ts redirects `require('@libsql/')` to it. + const libsqlNative = resolveLibsqlNative(target); + if (libsqlNative && existsSync(libsqlNative)) { + await cp(libsqlNative, join(binDir, "libsql.node")); + } + // Smoke test on current platform if (isCurrentPlatform(target)) { const bin = join(binDir, binaryName(target)); diff --git a/apps/cli/src/main.ts b/apps/cli/src/main.ts index bbc3187f8..cd27c3f90 100644 --- a/apps/cli/src/main.ts +++ b/apps/cli/src/main.ts @@ -1,3 +1,7 @@ +// MUST be first: publishes the colocated libSQL/keyring native `.node` paths +// before any import (e.g. `@executor-js/local` → libSQL) eagerly loads them. +import "./native-bindings"; + import { randomUUID } from "node:crypto"; import { existsSync, realpathSync } from "node:fs"; import { dirname, join, resolve } from "node:path"; @@ -8,24 +12,6 @@ if (process.env.PATH && !process.env.PATH.includes(execDir)) { process.env.PATH = `${execDir}:${process.env.PATH}`; } -// Point the keychain plugin at the colocated @napi-rs/keyring binding. -// bun --compile doesn't include .node files in bunfs, so the loader's -// normal `require('@napi-rs/keyring--')` walk fails inside the -// binary. We can't use NAPI_RS_NATIVE_LIBRARY_PATH because @napi-rs/keyring -// 1.2.0 has a bug where the env-var branch assigns to a local variable that -// gets overwritten before the binding is returned. build.ts copies the -// platform .node next to the executor; the keychain plugin reads this var -// and loads the file directly via createRequire, bypassing the broken -// loader. -const keyringNodeOnDisk = join(execDir, "keyring.node"); -if ( - typeof Bun !== "undefined" && - !process.env.EXECUTOR_KEYRING_NATIVE_PATH && - (await Bun.file(keyringNodeOnDisk).exists()) -) { - process.env.EXECUTOR_KEYRING_NATIVE_PATH = keyringNodeOnDisk; -} - // Pre-load QuickJS WASM for compiled binaries — must run before server imports const wasmOnDisk = join(execDir, "emscripten-module.wasm"); if (typeof Bun !== "undefined" && (await Bun.file(wasmOnDisk).exists())) { diff --git a/apps/cli/src/native-bindings.ts b/apps/cli/src/native-bindings.ts new file mode 100644 index 000000000..51cb04a7e --- /dev/null +++ b/apps/cli/src/native-bindings.ts @@ -0,0 +1,45 @@ +// --------------------------------------------------------------------------- +// Native-binding bootstrap for the `bun build --compile` binary. +// +// `bun --compile` bundles JS into bunfs but does NOT include `.node` native +// addons, so a dynamic `require('@libsql/')` / keyring walk inside +// the binary fails. build.ts copies each platform's `.node` next to the +// executable (`libsql.node`, `keyring.node`); here we publish their on-disk +// paths via env vars the loaders read. +// +// This MUST be the FIRST import in main.ts. ES modules evaluate every import +// before the importer's own body, and libSQL resolves its native addon EAGERLY +// at module load (`const {...} = requireNative()` in `libsql/index.js`). So the +// env var has to be set as a side effect of an import that is ordered before +// the `@executor-js/local` → `@libsql/client` graph — setting it in main.ts's +// body would run too late, after libSQL had already tried (and failed) to load. +// --------------------------------------------------------------------------- + +import { existsSync } from "node:fs"; +import { dirname, join } from "node:path"; + +const execDir = dirname(process.execPath); + +// libSQL: our `libsql` patch reads EXECUTOR_LIBSQL_NATIVE_PATH and loads the +// colocated binding directly, before its (in-bunfs, doomed) platform-package walk. +const libsqlNodeOnDisk = join(execDir, "libsql.node"); +if ( + typeof Bun !== "undefined" && + !process.env.EXECUTOR_LIBSQL_NATIVE_PATH && + existsSync(libsqlNodeOnDisk) +) { + process.env.EXECUTOR_LIBSQL_NATIVE_PATH = libsqlNodeOnDisk; +} + +// keyring: the keychain plugin reads EXECUTOR_KEYRING_NATIVE_PATH (lazily, but +// set here alongside libSQL so all native colocation lives in one place). We +// can't use NAPI_RS_NATIVE_LIBRARY_PATH — @napi-rs/keyring 1.2.0's env-var +// branch assigns to a local that gets overwritten before the binding returns. +const keyringNodeOnDisk = join(execDir, "keyring.node"); +if ( + typeof Bun !== "undefined" && + !process.env.EXECUTOR_KEYRING_NATIVE_PATH && + existsSync(keyringNodeOnDisk) +) { + process.env.EXECUTOR_KEYRING_NATIVE_PATH = keyringNodeOnDisk; +} diff --git a/bun.lock b/bun.lock index 982a734e7..8e1a6d1b7 100644 --- a/bun.lock +++ b/bun.lock @@ -1000,6 +1000,7 @@ }, }, "patchedDependencies": { + "libsql@0.5.29": "patches/libsql@0.5.29.patch", "postgres@3.4.9": "patches/postgres@3.4.9.patch", }, "catalog": { diff --git a/package.json b/package.json index fb91e64a6..3056682ad 100644 --- a/package.json +++ b/package.json @@ -126,6 +126,7 @@ }, "patchedDependencies": { "postgres@3.4.9": "patches/postgres@3.4.9.patch", - "@cloudflare/vite-plugin@1.31.2": "patches/@cloudflare%2Fvite-plugin@1.31.2.patch" + "@cloudflare/vite-plugin@1.31.2": "patches/@cloudflare%2Fvite-plugin@1.31.2.patch", + "libsql@0.5.29": "patches/libsql@0.5.29.patch" } } diff --git a/patches/libsql@0.5.29.patch b/patches/libsql@0.5.29.patch new file mode 100644 index 000000000..3e78bf4ed --- /dev/null +++ b/patches/libsql@0.5.29.patch @@ -0,0 +1,19 @@ +diff --git a/index.js b/index.js +index e24987954ec427320f51fd8037f9754b60ffa363..30522619ea99c6f988315b192525b647888a08e9 100644 +--- a/index.js ++++ b/index.js +@@ -4,6 +4,14 @@ const { load, currentTarget } = require("@neon-rs/load"); + const { familySync, GLIBC, MUSL } = require("detect-libc"); + + function requireNative() { ++ // Executor patch: inside a `bun build --compile` binary the platform package ++ // `@libsql/` isn't in bunfs and bun resolves this require natively ++ // (no JS module-resolver hook), so the normal walk fails. The Executor CLI ++ // copies the right `.node` next to the executable and points this env var at ++ // it; load it directly before the in-bunfs walk. ++ if (process.env.EXECUTOR_LIBSQL_NATIVE_PATH) { ++ return require(process.env.EXECUTOR_LIBSQL_NATIVE_PATH); ++ } + if (process.env.LIBSQL_JS_DEV) { + return load(__dirname) + } From 24ec99b7dfc40cdcc75d8a8317a4a17bef123349 Mon Sep 17 00:00:00 2001 From: Rhys Sullivan Date: Mon, 1 Jun 2026 15:56:34 -0700 Subject: [PATCH 27/31] Remove TanStack Start from the cloud auth chain; delete core-shared-services MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Experiment outcome: the 'ugliness' of api/core-shared-services.ts traced to a SINGLE import — handlers.ts's `setCookie`/`deleteCookie` from @tanstack/react-start/server, the only thing pulling Start into the layers.ts -> Durable Object graph. core-shared-services.ts existed solely to firewall that import out of the DO/test-worker bundle. Root fix (removes the coupling instead of just containing it): - handlers.ts: the 6 wos-session cookie ops drop the react-start import. logout (.handleRaw) uses the existing Effect deleteResponseCookie; the 5 typed .handle() handlers (switchOrganization/createOrganization/acceptInvitation) queue writes on a new request-scoped Session.cookies, applied to the response in SessionAuthLive via the SAME RESPONSE_COOKIE_OPTIONS/DELETE_COOKIE_OPTIONS constants, so the Set-Cookie bytes are identical. - middleware.ts: Session gains a cookies: SessionCookieWriter (no-op default for the account/SPA path); SessionCookieOptions is derived from setCookieUnsafe so it can't drift. With handlers.ts react-start-free, the layers.ts chain is too, so the firewall is unnecessary: core-shared-services.ts is DELETED and its CoreSharedServices alias moves beside WorkOSClient in auth/workos.ts (a focused service root the DO imports instead of the whole HTTP API). Bonus: the cloud API no longer depends on Start's ambient server context for cookies (runtime-agnostic direction). Verified: typecheck 38/38, lint+format clean, cloud node 106/106 (incl. the miniflare e2e DO bundling + the exact Set-Cookie assertions) and workers 82/82. --- .../account/workos-account-service.test.ts | 3 +- apps/cloud/src/api/core-shared-services.ts | 28 --------------- apps/cloud/src/api/layers.ts | 2 +- apps/cloud/src/api/protected.ts | 2 +- apps/cloud/src/app.ts | 2 +- apps/cloud/src/auth/handlers.ts | 20 +++++------ apps/cloud/src/auth/middleware-live.ts | 36 +++++++++++++++++-- apps/cloud/src/auth/middleware.test-layer.ts | 3 +- apps/cloud/src/auth/middleware.ts | 28 +++++++++++++++ apps/cloud/src/auth/workos.ts | 11 ++++++ apps/cloud/src/mcp/auth-provider.ts | 2 +- apps/cloud/src/mcp/auth.ts | 2 +- apps/cloud/src/mcp/session-durable-object.ts | 11 +++--- apps/cloud/src/testing/test-worker.ts | 2 +- 14 files changed, 99 insertions(+), 53 deletions(-) delete mode 100644 apps/cloud/src/api/core-shared-services.ts diff --git a/apps/cloud/src/account/workos-account-service.test.ts b/apps/cloud/src/account/workos-account-service.test.ts index 4b6e0c36f..ab89569be 100644 --- a/apps/cloud/src/account/workos-account-service.test.ts +++ b/apps/cloud/src/account/workos-account-service.test.ts @@ -8,7 +8,7 @@ import { AccountHandlers } from "@executor-js/api/server"; import { ApiKeyService } from "../auth/api-keys"; import { UserStoreService } from "../auth/context"; -import type { Session } from "../auth/middleware"; +import { noopCookieWriter, type Session } from "../auth/middleware"; import { WorkOSClient, type WorkOSClientService } from "../auth/workos"; import { AutumnService } from "../extensions/billing/service"; import { AccountCaller, workosAccountProvider } from "./workos-account-service"; @@ -31,6 +31,7 @@ const authedSession: Session = { organizationId: "org_1", sealedSession: "sealed_session", refreshedSession: null, + cookies: noopCookieWriter, }; const orgLessSession: Session = { ...authedSession, organizationId: null }; diff --git a/apps/cloud/src/api/core-shared-services.ts b/apps/cloud/src/api/core-shared-services.ts deleted file mode 100644 index 627544eca..000000000 --- a/apps/cloud/src/api/core-shared-services.ts +++ /dev/null @@ -1,28 +0,0 @@ -// Isolated leaf: the one neutral boot-scoped service (WorkOSClient) the MCP -// session DO and the miniflare test-worker both build on. This is the neutral -// DB/tracer core — it names NO billing service, so the DO (which never bills) -// does not transitively require one. Billing (`AutumnService`) is provided ONLY -// where it runs: the metered executor plane, the account seat-gate, the -// createOrganization free-limit gate, and the org domain-verification gate. -// -// Kept out of `./layers.ts` ON PURPOSE — this is the one file split the -// readability cleanup deliberately keeps. `./layers.ts` imports -// `auth/handlers.ts`, which imports `@tanstack/react-start/server`. The cloud -// production bundle resolves that chain through the TanStack Start Vite plugin, -// and the workerd vitest pool resolves the `#tanstack-*` subpath specifiers via -// `vitest.config.ts`'s `resolve.alias`. But the MCP DO test-worker is bundled -// by wrangler/esbuild (`mcp-miniflare.e2e.node.test.ts`'s `unstable_dev`), -// which has no alias hook AND can't supply Start's `tanstack-start-*:v` virtual -// modules — so it fails to bundle any module that transitively imports -// react-start. Importing `CoreSharedServices` from here keeps the DO bundle -// react-start-free. - -import { WorkOSClient } from "../auth/workos"; - -/** - * The neutral boot-scoped service, independent of how the DB or tracer is - * provisioned — both the stateless HTTP path (per-request DB via Hyperdrive) - * and the MCP session DO (long-lived DB + isolate-local tracer SDK) merge this - * with their own `DbLive` + `UserStoreLive` + telemetry layer. - */ -export const CoreSharedServices = WorkOSClient.Default; diff --git a/apps/cloud/src/api/layers.ts b/apps/cloud/src/api/layers.ts index 9b3c2dff5..d879329a3 100644 --- a/apps/cloud/src/api/layers.ts +++ b/apps/cloud/src/api/layers.ts @@ -20,7 +20,7 @@ import { ErrorCaptureLive } from "../observability"; import { AutumnService } from "../extensions/billing/service"; import { cloudPlugins } from "../plugins"; -import { CoreSharedServices } from "./core-shared-services"; +import { CoreSharedServices } from "../auth/workos"; const DbLive = DbService.Live; const UserStoreLive = UserStoreService.Live.pipe(Layer.provide(DbLive)); diff --git a/apps/cloud/src/api/protected.ts b/apps/cloud/src/api/protected.ts index ffe8b36c1..3d8a513bb 100644 --- a/apps/cloud/src/api/protected.ts +++ b/apps/cloud/src/api/protected.ts @@ -18,7 +18,7 @@ import { UserStoreService } from "../auth/context"; import { cloudIdentityFailureStrategy, workosIdentityLayer } from "../auth/workos-auth-provider"; import { AutumnService } from "../extensions/billing/service"; import { DbService } from "../db/db"; -import { CoreSharedServices } from "./core-shared-services"; +import { CoreSharedServices } from "../auth/workos"; import { CloudMeteredExecutionStackLayer } from "../engine/execution-stack-metered"; import { ProtectedCloudApiLive, RequestScopedServicesLive } from "./layers"; diff --git a/apps/cloud/src/app.ts b/apps/cloud/src/app.ts index 0ef70417e..9ae2bd124 100644 --- a/apps/cloud/src/app.ts +++ b/apps/cloud/src/app.ts @@ -4,7 +4,7 @@ import { HttpServer } from "effect/unstable/http"; import { DbProvider, ExecutorApp } from "@executor-js/api/server"; import { cloudPlugins } from "./plugins"; -import { CoreSharedServices } from "./api/core-shared-services"; +import { CoreSharedServices } from "./auth/workos"; import { makeCloudExtensionRoutes } from "./extensions/routes"; import { RequestScopedServicesLive } from "./api/layers"; import { CloudMeteringEngineDecorator } from "./engine/execution-stack-metered"; diff --git a/apps/cloud/src/auth/handlers.ts b/apps/cloud/src/auth/handlers.ts index 0ac1a515f..36be61674 100644 --- a/apps/cloud/src/auth/handlers.ts +++ b/apps/cloud/src/auth/handlers.ts @@ -1,7 +1,6 @@ import { HttpApi, HttpApiBuilder } from "effect/unstable/httpapi"; import { HttpServerResponse } from "effect/unstable/http"; import { Duration, Effect, Predicate } from "effect"; -import { setCookie, deleteCookie } from "@tanstack/react-start/server"; import { AUTH_PATHS, @@ -252,10 +251,11 @@ export const CloudSessionAuthHandlers = HttpApiBuilder.group( }; }), ) - .handleRaw("logout", () => { - deleteCookie("wos-session", { path: "/" }); - return Effect.succeed(HttpServerResponse.redirect("/", { status: 302 })); - }) + .handleRaw("logout", () => + Effect.succeed( + deleteResponseCookie(HttpServerResponse.redirect("/", { status: 302 }), "wos-session"), + ), + ) .handle("organizations", () => Effect.gen(function* () { const workos = yield* WorkOSClient; @@ -288,7 +288,7 @@ export const CloudSessionAuthHandlers = HttpApiBuilder.group( payload.organizationId, ); if (refreshed) { - setCookie("wos-session", refreshed, COOKIE_OPTIONS); + session.cookies.set("wos-session", refreshed, RESPONSE_COOKIE_OPTIONS); } }), ) @@ -355,11 +355,11 @@ export const CloudSessionAuthHandlers = HttpApiBuilder.group( verifiedOrgId: verified?.organizationId ?? null, }, ); - deleteCookie("wos-session", { path: "/" }); + session.cookies.set("wos-session", "", DELETE_COOKIE_OPTIONS); return yield* new WorkOSError(); } - setCookie("wos-session", refreshed, COOKIE_OPTIONS); + session.cookies.set("wos-session", refreshed, RESPONSE_COOKIE_OPTIONS); return { id: org.id, name: org.name }; }), ) @@ -448,11 +448,11 @@ export const CloudSessionAuthHandlers = HttpApiBuilder.group( refreshReturnedSession: refreshed != null, verifiedOrgId: verified?.organizationId ?? null, }); - deleteCookie("wos-session", { path: "/" }); + session.cookies.set("wos-session", "", DELETE_COOKIE_OPTIONS); return yield* new WorkOSError(); } - setCookie("wos-session", refreshed, COOKIE_OPTIONS); + session.cookies.set("wos-session", refreshed, RESPONSE_COOKIE_OPTIONS); return { id: org.id, name: org.name }; }), ) diff --git a/apps/cloud/src/auth/middleware-live.ts b/apps/cloud/src/auth/middleware-live.ts index c1549f4a1..7da128079 100644 --- a/apps/cloud/src/auth/middleware-live.ts +++ b/apps/cloud/src/auth/middleware-live.ts @@ -4,10 +4,18 @@ // --------------------------------------------------------------------------- import { Effect, Layer, Redacted } from "effect"; +import { HttpServerResponse } from "effect/unstable/http"; import { AuthContext, NoOrganization, Unauthorized } from "@executor-js/api/server"; -import { OrgAuth, SessionAuth, SessionContext, sessionFromSealed } from "./middleware"; +import { + OrgAuth, + SessionAuth, + SessionContext, + sessionFromSealed, + type SessionCookieOptions, + type SessionCookieWriter, +} from "./middleware"; import { WorkOSClient } from "./workos"; export const SessionAuthLive = Layer.effect( @@ -25,8 +33,30 @@ export const SessionAuthLive = Layer.effect( return yield* Effect.fail(new Unauthorized()); } - const session = sessionFromSealed(result, Redacted.value(credential)); - return yield* Effect.provideService(httpEffect, SessionContext, session); + // Per-request cookie queue. Typed `.handle()` session handlers (the + // WorkOS session-refresh on switchOrganization / createOrganization / + // pendingInvitations) return DATA, so they can't attach a Set-Cookie + // themselves — they queue writes on `session.cookies` and we drain the + // queue onto the response below. This is what lets `handlers.ts` drop + // the `@tanstack/react-start/server` `setCookie` import (the sole thing + // that pulled TanStack Start into the backend / Durable-Object graph). + const pending: Array<{ + readonly name: string; + readonly value: string; + readonly options: SessionCookieOptions; + }> = []; + const cookies: SessionCookieWriter = { + set: (name, value, options) => { + pending.push({ name, value, options }); + }, + }; + + const session = sessionFromSealed(result, Redacted.value(credential), cookies); + const response = yield* Effect.provideService(httpEffect, SessionContext, session); + return pending.reduce( + (res, c) => HttpServerResponse.setCookieUnsafe(res, c.name, c.value, c.options), + response, + ); }), }; }), diff --git a/apps/cloud/src/auth/middleware.test-layer.ts b/apps/cloud/src/auth/middleware.test-layer.ts index 4502a7921..b13c7c1f0 100644 --- a/apps/cloud/src/auth/middleware.test-layer.ts +++ b/apps/cloud/src/auth/middleware.test-layer.ts @@ -1,6 +1,6 @@ import { Effect, Layer } from "effect"; -import { SessionAuth, SessionContext, type Session } from "./middleware"; +import { noopCookieWriter, SessionAuth, SessionContext, type Session } from "./middleware"; export type SessionTestContext = Session; @@ -14,6 +14,7 @@ export const makeSessionTestContext = ( organizationId: "org_existing_1", sealedSession: "test_session", refreshedSession: null, + cookies: noopCookieWriter, ...overrides, }); diff --git a/apps/cloud/src/auth/middleware.ts b/apps/cloud/src/auth/middleware.ts index 089895395..07a34a35e 100644 --- a/apps/cloud/src/auth/middleware.ts +++ b/apps/cloud/src/auth/middleware.ts @@ -6,6 +6,7 @@ // --------------------------------------------------------------------------- import { Context } from "effect"; +import type { HttpServerResponse } from "effect/unstable/http"; import { HttpApiMiddleware, HttpApiSecurity } from "effect/unstable/httpapi"; // The executor-API identity seam lives in `@executor-js/api/server`: the one @@ -19,6 +20,29 @@ import { AuthContext, NoOrganization, Unauthorized } from "@executor-js/api/serv // Session — what every authenticated request gets // --------------------------------------------------------------------------- +// Cookie-write options — exactly the options `HttpServerResponse.setCookieUnsafe` +// accepts (derived so they can't drift; `import type` keeps this SPA-imported +// module free of any server runtime). The auth handlers hand over the same +// `RESPONSE_COOKIE_OPTIONS` / `DELETE_COOKIE_OPTIONS` constants the existing +// `setResponseCookie` path uses, so the emitted `Set-Cookie` bytes are identical. +export type SessionCookieOptions = NonNullable< + Parameters[3] +>; + +// A request-scoped cookie queue. Typed `.handle()` handlers (e.g. the WorkOS +// session-refresh on `switchOrganization`/`createOrganization`) return DATA, not +// an `HttpServerResponse`, so they can't attach a `Set-Cookie` directly. They +// queue cookies here; `SessionAuthLive` drains the queue onto the outgoing +// response. This replaces the old `@tanstack/react-start/server` `setCookie` +// import — the one thing that pulled TanStack Start into the backend graph. +export type SessionCookieWriter = { + /** Queue a `Set-Cookie` to apply to the response. */ + readonly set: (name: string, value: string, options: SessionCookieOptions) => void; +}; + +/** No-op writer for `Session` producers that never re-set the cookie (the account API). */ +export const noopCookieWriter: SessionCookieWriter = { set: () => {} }; + export type Session = { readonly accountId: string; readonly email: string; @@ -28,6 +52,8 @@ export type Session = { readonly organizationId: string | null; readonly sealedSession: string; readonly refreshedSession: string | null; + /** Queue cookie writes from a typed handler; applied to the response by `SessionAuthLive`. */ + readonly cookies: SessionCookieWriter; }; export class SessionContext extends Context.Service()( @@ -64,6 +90,7 @@ export const sealedSessionDisplayName = (result: SealedSessionResult): string | export const sessionFromSealed = ( result: SealedSessionResult, sealedSessionFallback: string, + cookies: SessionCookieWriter = noopCookieWriter, ): Session => ({ accountId: result.userId, email: result.email, @@ -72,6 +99,7 @@ export const sessionFromSealed = ( organizationId: result.organizationId ?? null, sealedSession: result.refreshedSession ?? sealedSessionFallback, refreshedSession: result.refreshedSession ?? null, + cookies, }); // --------------------------------------------------------------------------- diff --git a/apps/cloud/src/auth/workos.ts b/apps/cloud/src/auth/workos.ts index abf04b666..02b1ce385 100644 --- a/apps/cloud/src/auth/workos.ts +++ b/apps/cloud/src/auth/workos.ts @@ -413,6 +413,17 @@ export class WorkOSClient extends Context.Service { if (!cookieHeader) return null; const match = cookieHeader diff --git a/apps/cloud/src/mcp/auth-provider.ts b/apps/cloud/src/mcp/auth-provider.ts index 769a136cb..33b676f9e 100644 --- a/apps/cloud/src/mcp/auth-provider.ts +++ b/apps/cloud/src/mcp/auth-provider.ts @@ -37,7 +37,7 @@ import { } from "@executor-js/host-mcp"; import { ApiKeyService } from "../auth/api-keys"; -import { CoreSharedServices } from "../api/core-shared-services"; +import { CoreSharedServices } from "../auth/workos"; import { bearerChallengeFor, mcpOrganizationFromRequest, diff --git a/apps/cloud/src/mcp/auth.ts b/apps/cloud/src/mcp/auth.ts index 183decd60..79a6e7d33 100644 --- a/apps/cloud/src/mcp/auth.ts +++ b/apps/cloud/src/mcp/auth.ts @@ -17,7 +17,7 @@ import { ApiKeyService } from "../auth/api-keys"; import { BEARER_PREFIX } from "../auth/bearer"; import { authorizeOrganization } from "../auth/organization"; import { UserStoreService } from "../auth/context"; -import { CoreSharedServices } from "../api/core-shared-services"; +import { CoreSharedServices } from "../auth/workos"; import { DbService } from "../db/db"; import { bearerChallenge } from "./responses"; import { McpJwtVerificationError, verifyWorkOSMcpAccessToken, type VerifiedToken } from "./jwt"; diff --git a/apps/cloud/src/mcp/session-durable-object.ts b/apps/cloud/src/mcp/session-durable-object.ts index 4c3a00721..de2ef2a58 100644 --- a/apps/cloud/src/mcp/session-durable-object.ts +++ b/apps/cloud/src/mcp/session-durable-object.ts @@ -33,10 +33,13 @@ import { // The DO only needs the neutral boot-scoped service (WorkOSClient). It never // bills, so it does NOT depend on any billing service — `CloudExecutionStackLayer` -// here is the no-op-decorator (Autumn-free) stack. Imported from the isolated -// leaf (not `../api/layers`) so the DO bundle stays free of `auth/handlers.ts` → -// `@tanstack/react-start/server`; see `../api/core-shared-services.ts`. -import { CoreSharedServices } from "../api/core-shared-services"; +// here is the no-op-decorator (Autumn-free) stack. It imports the focused +// `CoreSharedServices` root (beside `WorkOSClient`), NOT `../api/layers`, so the +// DO bundle stays small and free of the whole HTTP API assembly. (This used to +// require a dedicated `core-shared-services.ts` leaf to keep `auth/handlers.ts` → +// `@tanstack/react-start` out of the DO bundle; that coupling is gone now that +// `handlers.ts` queues cookies through `SessionAuthLive` instead.) +import { CoreSharedServices } from "../auth/workos"; import { UserStoreService } from "../auth/context"; import { resolveOrganization } from "../auth/organization"; import { diff --git a/apps/cloud/src/testing/test-worker.ts b/apps/cloud/src/testing/test-worker.ts index dd61a62d7..32652b904 100644 --- a/apps/cloud/src/testing/test-worker.ts +++ b/apps/cloud/src/testing/test-worker.ts @@ -32,7 +32,7 @@ import { ApiKeyService } from "../auth/api-keys"; import { organizations } from "../db/schema"; import { parseTestBearer } from "./test-bearer"; import { DoTelemetryLive } from "../observability/telemetry"; -import { CoreSharedServices } from "../api/core-shared-services"; +import { CoreSharedServices } from "../auth/workos"; export { McpSessionDO } from "../mcp/session-durable-object"; From a1d38604f0788be637b17640d0e786f5e146356e Mon Sep 17 00:00:00 2001 From: Rhys Sullivan Date: Mon, 1 Jun 2026 16:09:06 -0700 Subject: [PATCH 28/31] Split SessionCookies into its own service (drop the Session.cookies no-op) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Follow-up to the react-start removal: the cookie writer was a field on the Session data type, which forced every Session producer that never writes a cookie (OrgAuth, the account API, test fixtures) to supply a meaningless noopCookieWriter. That null-object was the tell that a write capability had been bolted onto a data shape. Make it a proper request-scoped service instead: SessionCookies. SessionAuth now declares `provides: SessionContext | SessionCookies` (a security middleware can provide a union — the handler R is Exclude), and SessionAuthLive provides both then drains the queue onto the response. The 5 typed handlers `yield* SessionCookies` only where they actually refresh the cookie. Session reverts to pure data; sessionFromSealed loses its cookies param. Net: no production no-op anywhere (only an inline test-fixture stub in the test layer, which is normal). Verified: typecheck 38/38, lint+format clean, cloud node 106/106 (incl. exact Set-Cookie assertions + the miniflare e2e) and workers 82/82. --- .../account/workos-account-service.test.ts | 3 +- apps/cloud/src/auth/handlers.ts | 12 +++--- apps/cloud/src/auth/middleware-live.ts | 18 +++++--- apps/cloud/src/auth/middleware.test-layer.ts | 11 +++-- apps/cloud/src/auth/middleware.ts | 43 ++++++++++--------- 5 files changed, 49 insertions(+), 38 deletions(-) diff --git a/apps/cloud/src/account/workos-account-service.test.ts b/apps/cloud/src/account/workos-account-service.test.ts index ab89569be..4b6e0c36f 100644 --- a/apps/cloud/src/account/workos-account-service.test.ts +++ b/apps/cloud/src/account/workos-account-service.test.ts @@ -8,7 +8,7 @@ import { AccountHandlers } from "@executor-js/api/server"; import { ApiKeyService } from "../auth/api-keys"; import { UserStoreService } from "../auth/context"; -import { noopCookieWriter, type Session } from "../auth/middleware"; +import type { Session } from "../auth/middleware"; import { WorkOSClient, type WorkOSClientService } from "../auth/workos"; import { AutumnService } from "../extensions/billing/service"; import { AccountCaller, workosAccountProvider } from "./workos-account-service"; @@ -31,7 +31,6 @@ const authedSession: Session = { organizationId: "org_1", sealedSession: "sealed_session", refreshedSession: null, - cookies: noopCookieWriter, }; const orgLessSession: Session = { ...authedSession, organizationId: null }; diff --git a/apps/cloud/src/auth/handlers.ts b/apps/cloud/src/auth/handlers.ts index 36be61674..5b9e12f0c 100644 --- a/apps/cloud/src/auth/handlers.ts +++ b/apps/cloud/src/auth/handlers.ts @@ -10,7 +10,7 @@ import { McpSessionForbiddenError, } from "./api"; import { NoOrganization } from "@executor-js/api/server"; -import { SessionContext } from "./middleware"; +import { SessionContext, SessionCookies } from "./middleware"; import { UserStoreService } from "./context"; import { env } from "cloudflare:workers"; import { WorkOSError } from "./errors"; @@ -288,7 +288,7 @@ export const CloudSessionAuthHandlers = HttpApiBuilder.group( payload.organizationId, ); if (refreshed) { - session.cookies.set("wos-session", refreshed, RESPONSE_COOKIE_OPTIONS); + (yield* SessionCookies).set("wos-session", refreshed, RESPONSE_COOKIE_OPTIONS); } }), ) @@ -355,11 +355,11 @@ export const CloudSessionAuthHandlers = HttpApiBuilder.group( verifiedOrgId: verified?.organizationId ?? null, }, ); - session.cookies.set("wos-session", "", DELETE_COOKIE_OPTIONS); + (yield* SessionCookies).set("wos-session", "", DELETE_COOKIE_OPTIONS); return yield* new WorkOSError(); } - session.cookies.set("wos-session", refreshed, RESPONSE_COOKIE_OPTIONS); + (yield* SessionCookies).set("wos-session", refreshed, RESPONSE_COOKIE_OPTIONS); return { id: org.id, name: org.name }; }), ) @@ -448,11 +448,11 @@ export const CloudSessionAuthHandlers = HttpApiBuilder.group( refreshReturnedSession: refreshed != null, verifiedOrgId: verified?.organizationId ?? null, }); - session.cookies.set("wos-session", "", DELETE_COOKIE_OPTIONS); + (yield* SessionCookies).set("wos-session", "", DELETE_COOKIE_OPTIONS); return yield* new WorkOSError(); } - session.cookies.set("wos-session", refreshed, RESPONSE_COOKIE_OPTIONS); + (yield* SessionCookies).set("wos-session", refreshed, RESPONSE_COOKIE_OPTIONS); return { id: org.id, name: org.name }; }), ) diff --git a/apps/cloud/src/auth/middleware-live.ts b/apps/cloud/src/auth/middleware-live.ts index 7da128079..16ac3a4ff 100644 --- a/apps/cloud/src/auth/middleware-live.ts +++ b/apps/cloud/src/auth/middleware-live.ts @@ -12,9 +12,10 @@ import { OrgAuth, SessionAuth, SessionContext, + SessionCookies, sessionFromSealed, type SessionCookieOptions, - type SessionCookieWriter, + type SessionCookieSetter, } from "./middleware"; import { WorkOSClient } from "./workos"; @@ -35,9 +36,9 @@ export const SessionAuthLive = Layer.effect( // Per-request cookie queue. Typed `.handle()` session handlers (the // WorkOS session-refresh on switchOrganization / createOrganization / - // pendingInvitations) return DATA, so they can't attach a Set-Cookie - // themselves — they queue writes on `session.cookies` and we drain the - // queue onto the response below. This is what lets `handlers.ts` drop + // acceptInvitation) return DATA, so they can't attach a Set-Cookie + // themselves — they `yield* SessionCookies` and queue writes, which we + // drain onto the response below. This is what lets `handlers.ts` drop // the `@tanstack/react-start/server` `setCookie` import (the sole thing // that pulled TanStack Start into the backend / Durable-Object graph). const pending: Array<{ @@ -45,14 +46,17 @@ export const SessionAuthLive = Layer.effect( readonly value: string; readonly options: SessionCookieOptions; }> = []; - const cookies: SessionCookieWriter = { + const cookieSetter: SessionCookieSetter = { set: (name, value, options) => { pending.push({ name, value, options }); }, }; - const session = sessionFromSealed(result, Redacted.value(credential), cookies); - const response = yield* Effect.provideService(httpEffect, SessionContext, session); + const session = sessionFromSealed(result, Redacted.value(credential)); + const response = yield* httpEffect.pipe( + Effect.provideService(SessionContext, session), + Effect.provideService(SessionCookies, cookieSetter), + ); return pending.reduce( (res, c) => HttpServerResponse.setCookieUnsafe(res, c.name, c.value, c.options), response, diff --git a/apps/cloud/src/auth/middleware.test-layer.ts b/apps/cloud/src/auth/middleware.test-layer.ts index b13c7c1f0..bff3fae79 100644 --- a/apps/cloud/src/auth/middleware.test-layer.ts +++ b/apps/cloud/src/auth/middleware.test-layer.ts @@ -1,6 +1,6 @@ import { Effect, Layer } from "effect"; -import { noopCookieWriter, SessionAuth, SessionContext, type Session } from "./middleware"; +import { SessionAuth, SessionContext, SessionCookies, type Session } from "./middleware"; export type SessionTestContext = Session; @@ -14,11 +14,16 @@ export const makeSessionTestContext = ( organizationId: "org_existing_1", sealedSession: "test_session", refreshedSession: null, - cookies: noopCookieWriter, ...overrides, }); export const SessionAuthTestLayer = (session: Session = makeSessionTestContext()) => Layer.succeed(SessionAuth)({ - cookie: (httpEffect) => Effect.provideService(httpEffect, SessionContext, session), + cookie: (httpEffect) => + httpEffect.pipe( + Effect.provideService(SessionContext, session), + // The session handlers driven via this layer don't assert cookie output; + // a no-op setter satisfies the SessionCookies the middleware provides. + Effect.provideService(SessionCookies, { set: () => {} }), + ), }); diff --git a/apps/cloud/src/auth/middleware.ts b/apps/cloud/src/auth/middleware.ts index 07a34a35e..cecd1a64f 100644 --- a/apps/cloud/src/auth/middleware.ts +++ b/apps/cloud/src/auth/middleware.ts @@ -29,20 +29,6 @@ export type SessionCookieOptions = NonNullable< Parameters[3] >; -// A request-scoped cookie queue. Typed `.handle()` handlers (e.g. the WorkOS -// session-refresh on `switchOrganization`/`createOrganization`) return DATA, not -// an `HttpServerResponse`, so they can't attach a `Set-Cookie` directly. They -// queue cookies here; `SessionAuthLive` drains the queue onto the outgoing -// response. This replaces the old `@tanstack/react-start/server` `setCookie` -// import — the one thing that pulled TanStack Start into the backend graph. -export type SessionCookieWriter = { - /** Queue a `Set-Cookie` to apply to the response. */ - readonly set: (name: string, value: string, options: SessionCookieOptions) => void; -}; - -/** No-op writer for `Session` producers that never re-set the cookie (the account API). */ -export const noopCookieWriter: SessionCookieWriter = { set: () => {} }; - export type Session = { readonly accountId: string; readonly email: string; @@ -52,14 +38,31 @@ export type Session = { readonly organizationId: string | null; readonly sealedSession: string; readonly refreshedSession: string | null; - /** Queue cookie writes from a typed handler; applied to the response by `SessionAuthLive`. */ - readonly cookies: SessionCookieWriter; }; export class SessionContext extends Context.Service()( "@executor-js/cloud/Session", ) {} +// A request-scoped cookie setter, provided ALONGSIDE `SessionContext` by +// `SessionAuth` (see its `provides` below). Typed `.handle()` handlers — the +// WorkOS session-refresh on switchOrganization / createOrganization / +// acceptInvitation — return DATA, not an `HttpServerResponse`, so they can't +// attach a `Set-Cookie` directly. They `yield* SessionCookies` and queue writes; +// `SessionAuthLive` drains the queue onto the outgoing response. It's a SEPARATE +// service, not a field on `Session`, so the session DATA stays pure — `OrgAuth` +// and the account API build a `Session` but never write cookies, so they carry +// no writer. This replaces the old `@tanstack/react-start/server` `setCookie` +// import (the one thing that pulled TanStack Start into the backend graph). +export type SessionCookieSetter = { + /** Queue a `Set-Cookie` to apply to the response. */ + readonly set: (name: string, value: string, options: SessionCookieOptions) => void; +}; + +export class SessionCookies extends Context.Service()( + "@executor-js/cloud/SessionCookies", +) {} + /** * The authenticated result shape `WorkOSClient.authenticateSealedSession` / * `authenticateRequest` yield. Structural so the mapper below stays a pure @@ -90,7 +93,6 @@ export const sealedSessionDisplayName = (result: SealedSessionResult): string | export const sessionFromSealed = ( result: SealedSessionResult, sealedSessionFallback: string, - cookies: SessionCookieWriter = noopCookieWriter, ): Session => ({ accountId: result.userId, email: result.email, @@ -99,16 +101,17 @@ export const sessionFromSealed = ( organizationId: result.organizationId ?? null, sealedSession: result.refreshedSession ?? sealedSessionFallback, refreshedSession: result.refreshedSession ?? null, - cookies, }); // --------------------------------------------------------------------------- -// SessionAuth — resolves the WorkOS session cookie, provides SessionContext +// SessionAuth — resolves the WorkOS session cookie; provides SessionContext AND +// the SessionCookies setter (so a typed handler can queue a session-cookie +// refresh that SessionAuthLive applies to the response). // --------------------------------------------------------------------------- export class SessionAuth extends HttpApiMiddleware.Service< SessionAuth, - { provides: SessionContext } + { provides: SessionContext | SessionCookies } >()("SessionAuth", { error: Unauthorized, security: { From 6562efc7f0ecddc8d0fc4fcbaba5d7ce27a3a3c8 Mon Sep 17 00:00:00 2001 From: Rhys Sullivan Date: Mon, 1 Jun 2026 17:25:17 -0700 Subject: [PATCH 29/31] gitignore: ignore all .executor-* data dirs + any secret.key The glob .executor-dev/ missed the self-host data dir .executor-selfhost/, so apps/host-selfhost/.executor-selfhost/secret.key (a generated dev session key) got committed in 815471959. Broaden to .executor-*/ to cover every per-app data dir, add a belt-and-suspenders secret.key rule, and untrack the leaked key (it stays on disk, regenerated on next boot). --- .gitignore | 8 ++++++-- apps/host-selfhost/.executor-selfhost/secret.key | 1 - 2 files changed, 6 insertions(+), 3 deletions(-) delete mode 100644 apps/host-selfhost/.executor-selfhost/secret.key diff --git a/.gitignore b/.gitignore index f34fc003a..bece0a66d 100644 --- a/.gitignore +++ b/.gitignore @@ -45,8 +45,12 @@ personal-notes/ *.har.executor executor.har .executor/ -# Per-app dev runtime dirs (local SQLite DB + generated dev secret.key) — never commit -.executor-dev/ +# Per-app dev runtime data dirs (local SQLite DB + generated secret.key) — never +# commit. Glob covers .executor-dev (cloud/cloudflare dev) AND .executor-selfhost +# (the self-host data dir) and any future .executor- dir. +.executor-*/ +# Belt-and-suspenders: never commit a generated session/at-rest key, wherever it lands. +secret.key # desktop app build artifacts apps/desktop/resources/ diff --git a/apps/host-selfhost/.executor-selfhost/secret.key b/apps/host-selfhost/.executor-selfhost/secret.key deleted file mode 100644 index 042fa11ed..000000000 --- a/apps/host-selfhost/.executor-selfhost/secret.key +++ /dev/null @@ -1 +0,0 @@ -f791Y+ZWt0l8Zguif5YjmU/WhDkjCUNsTzN9ntxZiWk= \ No newline at end of file From 296e3b9eec32c7470365ac0a4fe9ea91d8961972 Mon Sep 17 00:00:00 2001 From: Rhys Sullivan Date: Mon, 1 Jun 2026 17:25:17 -0700 Subject: [PATCH 30/31] Cut the dead plugins->schema path: collectTables() is plugin-independent MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Plugins persist through host-owned facades (pluginStorage/blobs), not their own tables, so collectTables ignored its plugins arg and returned the fixed coreSchema. Drop the dead coupling: - collectTables() takes no args; update all call sites (runtime, hosts, tests). - The DB handles (d1.ts, self-host-db.ts) no longer take/thread plugins; the CF Durable Object sheds its cfPlugins field entirely. - `schema generate` no longer loads executor.config.ts — the table set is fixed and host-independent, so the command needs only --namespace/--adapter/--provider (dropped --config; cloud db:schema script updated). - Fix stale comments claiming plugins feed the FumaDB schema. Behavior-preserving: the generated schema is byte-identical (table content unchanged; verified by regen). typecheck 38/38, lint+format clean, scope-policy tests pass. --- apps/cloud/executor.config.ts | 7 +++++-- apps/cloud/package.json | 2 +- apps/cloud/src/db/db.schema.test.ts | 3 +-- apps/cloud/src/engine/execution-stack.ts | 7 +++---- apps/cloud/src/mcp-session.e2e.node.test.ts | 2 +- apps/cloud/src/testing/api-harness.ts | 2 +- apps/host-cloudflare/src/app.ts | 2 +- apps/host-cloudflare/src/db/d1.ts | 6 ++---- .../src/mcp/session-durable-object.ts | 5 +---- apps/host-selfhost/src/db/self-host-db.ts | 3 +-- apps/local/src/auth-tool-failures.test.ts | 2 +- apps/local/src/db/sqlite-import.test.ts | 20 +++++++++---------- apps/local/src/executor.ts | 2 +- apps/local/src/mcp-browser-resume.test.ts | 2 +- apps/local/src/mcp-oauth.test.ts | 2 +- packages/core/cli/src/commands/schema.ts | 19 ++++++------------ packages/core/sdk/src/executor.ts | 8 ++++---- packages/core/sdk/src/promise-executor.ts | 10 ++++------ packages/core/sdk/src/scope-policy.test.ts | 4 ++-- packages/core/sdk/src/test-config.ts | 2 +- .../scripts/test-globalsetup.ts | 3 +-- .../src/integration.test.ts | 2 +- 22 files changed, 50 insertions(+), 65 deletions(-) diff --git a/apps/cloud/executor.config.ts b/apps/cloud/executor.config.ts index 7e38211c7..941e7bfaa 100644 --- a/apps/cloud/executor.config.ts +++ b/apps/cloud/executor.config.ts @@ -8,13 +8,16 @@ import { workosVaultPlugin, type WorkOSVaultClient } from "@executor-js/plugin-w // Single source of truth for the cloud app's plugin list. // // Consumed by: -// - FumaDB schema wiring (calls `plugins({})`) // - the host runtime (calls `plugins({ workosCredentials })` per request) +// - the build/UI tooling (the vite plugin calls `plugins()` no-arg, reads +// `plugin.packageName` only) // - the test harness (calls `plugins({ workosVaultClient })` per test) +// (NOT by schema generation — the executor table set is fixed and +// plugin-independent, see `collectTables()`.) // // `TDeps` is inferred directly from the factory parameter annotation — // no global `declare module "@executor-js/sdk"` augmentation. Each -// caller (runtime / schema wiring / tests) passes whatever subset of the deps +// caller (runtime / build tooling / tests) passes whatever subset of the deps // it has; all fields are optional so `plugins({})` keeps working. // // Cloud only ships plugins safe to run in a multi-tenant setting — no diff --git a/apps/cloud/package.json b/apps/cloud/package.json index 7967fbc04..aa88eb60f 100644 --- a/apps/cloud/package.json +++ b/apps/cloud/package.json @@ -8,7 +8,7 @@ "dev:proxy": "portless proxy start --multiplex --shared-port --port 5394 || (portless proxy stop -p 5394 && portless proxy start --multiplex --shared-port --port 5394)", "dev:db": "bun run scripts/dev-db.ts", "dev:vite": "EXECUTOR_DIRECT_DATABASE_URL=true CLOUDFLARE_INCLUDE_PROCESS_ENV=true op run --env-file=.env.op -- portless --name executor-cloud vite dev", - "db:schema": "node --import jiti/register ../../packages/core/cli/src/index.ts schema generate --config ./executor.config.ts --output ./src/db/executor-schema.ts --namespace executor_cloud --adapter drizzle --provider postgresql", + "db:schema": "node --import jiti/register ../../packages/core/cli/src/index.ts schema generate --output ./src/db/executor-schema.ts --namespace executor_cloud --adapter drizzle --provider postgresql", "db:generate": "drizzle-kit generate", "db:studio": "drizzle-kit studio", "db:studio:prod": "op run --env-file=.env.production -- bun --bun ../../node_modules/.bun/node_modules/drizzle-kit/bin.cjs studio", diff --git a/apps/cloud/src/db/db.schema.test.ts b/apps/cloud/src/db/db.schema.test.ts index 0ba950628..1bcf14c6d 100644 --- a/apps/cloud/src/db/db.schema.test.ts +++ b/apps/cloud/src/db/db.schema.test.ts @@ -20,7 +20,6 @@ import postgres from "postgres"; import { collectTables } from "@executor-js/sdk"; -import executorConfig from "../../executor.config"; import * as cloudSchema from "./schema"; import * as executorSchema from "./executor-schema"; import { combinedSchema } from "./db"; @@ -102,7 +101,7 @@ describe("combinedSchema", () => { const db = drizzle(sql, { schema: combinedSchema }); const fuma = createDrizzleFumaDb({ db, - tables: collectTables(executorConfig.plugins({})), + tables: collectTables(), namespace: "executor_cloud", provider: "postgresql", }); diff --git a/apps/cloud/src/engine/execution-stack.ts b/apps/cloud/src/engine/execution-stack.ts index ea7ce4ca1..beb5ead85 100644 --- a/apps/cloud/src/engine/execution-stack.ts +++ b/apps/cloud/src/engine/execution-stack.ts @@ -45,15 +45,14 @@ import { import { makeDynamicWorkerExecutor } from "@executor-js/runtime-dynamic-worker"; import executorConfig from "../../executor.config"; -import { cloudPlugins } from "../plugins"; import { DbService } from "../db/db"; import { cloudDbProviderLayer } from "../db/fuma"; export { makeExecutionStack } from "@executor-js/api/server"; -// The plugin table set is stable (derived from the static `cloudPlugins` tuple), -// so the per-request DbProvider rebuilds the fuma client over the same schema. -export const CloudDbProvider = cloudDbProviderLayer(collectTables(cloudPlugins)); +// The executor table set is fixed (plugin-independent), so the per-request +// DbProvider rebuilds the fuma client over the same schema. +export const CloudDbProvider = cloudDbProviderLayer(collectTables()); // Fresh plugin instances per request, carrying the Worker env's WorkOS Vault // credentials. Matches the old `createScopedExecutor`'s `orgPlugins()`. diff --git a/apps/cloud/src/mcp-session.e2e.node.test.ts b/apps/cloud/src/mcp-session.e2e.node.test.ts index 83eff73b9..c49955795 100644 --- a/apps/cloud/src/mcp-session.e2e.node.test.ts +++ b/apps/cloud/src/mcp-session.e2e.node.test.ts @@ -108,7 +108,7 @@ const buildScopedExecutor = (scopeId: string, scopeName: string, options: BuildO : basePlugins; const fuma = createDrizzleFumaDb({ db, - tables: collectTables(plugins), + tables: collectTables(), namespace: "executor_cloud", provider: "postgresql", }); diff --git a/apps/cloud/src/testing/api-harness.ts b/apps/cloud/src/testing/api-harness.ts index 56b931338..c26cfab80 100644 --- a/apps/cloud/src/testing/api-harness.ts +++ b/apps/cloud/src/testing/api-harness.ts @@ -69,7 +69,7 @@ const createTestScopedExecutor = ( const plugins = testPlugins; const fuma = createDrizzleFumaDb({ db, - tables: collectTables(plugins), + tables: collectTables(), namespace: "executor_cloud", provider: "postgresql", }); diff --git a/apps/host-cloudflare/src/app.ts b/apps/host-cloudflare/src/app.ts index c59912bf8..b664e8a32 100644 --- a/apps/host-cloudflare/src/app.ts +++ b/apps/host-cloudflare/src/app.ts @@ -41,7 +41,7 @@ export const makeCloudflareApp = async (env: CloudflareEnv) => { // Open + idempotently bring up the D1 schema once (the long-lived handle the // per-request scoped executor reads through the DbProvider seam). - const dbHandle = await createD1ExecutorDb(env.DB, env.BLOBS, plugins); + const dbHandle = await createD1ExecutorDb(env.DB, env.BLOBS); const identityLayer = cloudflareAccessIdentityLayer(config); // MCP runs through the `MCP_SESSION` Durable Object (cross-isolate sessions); // each session DO opens its own D1 handle, so it takes `env`, not `dbHandle`. diff --git a/apps/host-cloudflare/src/db/d1.ts b/apps/host-cloudflare/src/db/d1.ts index d0b4c592c..558eb6487 100644 --- a/apps/host-cloudflare/src/db/d1.ts +++ b/apps/host-cloudflare/src/db/d1.ts @@ -14,13 +14,12 @@ import { } from "@executor-js/api/server"; import { CLOUDFLARE_NAMESPACE, CLOUDFLARE_SCHEMA_VERSION } from "../config"; -import type { CloudflarePlugins } from "../plugins"; // --------------------------------------------------------------------------- // D1 DbProvider handle — the CF-native swap for self-host's libSQL handle. // // D1 is SQLite, so this reuses the SAME shared FumaDB assembly self-host uses: -// build the runtime schema from the plugins' tables, open drizzle over the D1 +// build the runtime schema from the fixed executor table set, open drizzle over the D1 // binding (drizzle-orm/d1), run the idempotent `ensureDrizzleRuntimeSchemaFrom- // Tables` bring-up (generic CREATE TABLE IF NOT EXISTS over D1), and assemble // `createExecutorFumaDb`. No driver to open (the binding is the connection), no @@ -30,10 +29,9 @@ import type { CloudflarePlugins } from "../plugins"; export const createD1ExecutorDb = async ( db: D1Database, blobs: R2Bucket | undefined, - plugins: CloudflarePlugins, ): Promise => { const options = { - tables: collectTables(plugins), + tables: collectTables(), namespace: CLOUDFLARE_NAMESPACE, version: CLOUDFLARE_SCHEMA_VERSION, provider: "sqlite" as const, diff --git a/apps/host-cloudflare/src/mcp/session-durable-object.ts b/apps/host-cloudflare/src/mcp/session-durable-object.ts index 372c7b9ac..258e70c41 100644 --- a/apps/host-cloudflare/src/mcp/session-durable-object.ts +++ b/apps/host-cloudflare/src/mcp/session-durable-object.ts @@ -10,7 +10,6 @@ import { } from "@executor-js/cloudflare/mcp/durable-object"; import { loadConfig, type CloudflareConfig, type CloudflareEnv } from "../config"; -import { makeCloudflarePlugins, type CloudflarePlugins } from "../plugins"; import { createD1ExecutorDb } from "../db/d1"; import { makeCloudflareExecutionStackLayer, makeExecutionStack } from "../execution"; import { preloadQuickJs } from "../quickjs"; @@ -38,7 +37,6 @@ type CfSessionDbHandle = ExecutorDbHandle & { readonly end: () => Promise export class McpSessionDO extends McpSessionDOBase { private readonly cfEnv: CloudflareEnv; private readonly cfConfig: CloudflareConfig; - private readonly cfPlugins: CloudflarePlugins; // `ctx`'s type is taken from the base constructor so it tracks whichever // `@cloudflare/workers-types` the shared package resolves (avoids a @@ -47,11 +45,10 @@ export class McpSessionDO extends McpSessionDOBase { super(ctx, env); this.cfEnv = env; this.cfConfig = loadConfig(env); - this.cfPlugins = makeCloudflarePlugins(this.cfConfig.secretKey); } protected override async openSessionDb(): Promise { - const handle = await createD1ExecutorDb(this.cfEnv.DB, this.cfEnv.BLOBS, this.cfPlugins); + const handle = await createD1ExecutorDb(this.cfEnv.DB, this.cfEnv.BLOBS); return { ...handle, end: () => handle.close() }; } diff --git a/apps/host-selfhost/src/db/self-host-db.ts b/apps/host-selfhost/src/db/self-host-db.ts index 339d9ec74..b595c8a56 100644 --- a/apps/host-selfhost/src/db/self-host-db.ts +++ b/apps/host-selfhost/src/db/self-host-db.ts @@ -19,7 +19,6 @@ import { } from "@executor-js/api/server"; import type { FumaDb, FumaTables } from "@executor-js/sdk"; -import { selfHostPlugins } from "../plugins"; import { SELF_HOST_NAMESPACE, SELF_HOST_SCHEMA_VERSION } from "../config"; // --------------------------------------------------------------------------- @@ -153,7 +152,7 @@ export interface SelfHostDbLayerOptions { */ export const createSelfHostDb = (options: SelfHostDbLayerOptions): Promise => createSqliteExecutorDb({ - tables: collectTables(selfHostPlugins), + tables: collectTables(), namespace: options.namespace ?? SELF_HOST_NAMESPACE, version: options.version ?? SELF_HOST_SCHEMA_VERSION, path: options.path, diff --git a/apps/local/src/auth-tool-failures.test.ts b/apps/local/src/auth-tool-failures.test.ts index a9c09d294..90ab38d87 100644 --- a/apps/local/src/auth-tool-failures.test.ts +++ b/apps/local/src/auth-tool-failures.test.ts @@ -77,7 +77,7 @@ const startHarness = async (tmpDir: string): Promise => { fileSecretsPlugin({ directory: tmpDir }), ] as const; const sqlite = await createSqliteFumaDb({ - tables: collectTables(plugins), + tables: collectTables(), namespace: "executor_local_auth_tool_failures_test", path: join(tmpDir, "data.db"), }); diff --git a/apps/local/src/db/sqlite-import.test.ts b/apps/local/src/db/sqlite-import.test.ts index 49256772c..1c8d575ee 100644 --- a/apps/local/src/db/sqlite-import.test.ts +++ b/apps/local/src/db/sqlite-import.test.ts @@ -190,7 +190,7 @@ describe("importSqliteDataToFuma", () => { const markerPath = join(workDir, "fumadb-sqlite-imported"); await seedSqlite(sqlitePath); - const tables = collectTables([]); + const tables = collectTables(); sqlite = await createSqliteFumaDb({ tables, namespace: "executor_local_test", @@ -279,7 +279,7 @@ describe("importSqliteDataToFuma", () => { ); db.close(); - const tables = collectTables([]); + const tables = collectTables(); const legacyScopeIds = await readLegacySqliteScopeIds({ sqlitePath, tables, @@ -346,7 +346,7 @@ describe("importSqliteDataToFuma", () => { db.close(); const tables: FumaTables = { - ...collectTables([]), + ...collectTables(), ...legacyShapeSchema, }; sqlite = await createSqliteFumaDb({ @@ -385,7 +385,7 @@ describe("importSqliteDataToFuma", () => { const markerPath = join(workDir, "fumadb-sqlite-imported"); await seedMigratedSqlite(sqlitePath); - const tables = collectTables([]); + const tables = collectTables(); const result = await importLegacySqliteIfNeeded({ storage: { dataDir: workDir, @@ -420,7 +420,7 @@ describe("importSqliteDataToFuma", () => { migrationHashes: ["different-branch-migration", "newer-branch-migration"], }); - const tables = collectTables([]); + const tables = collectTables(); const result = await importLegacySqliteIfNeeded({ storage: { dataDir: workDir, @@ -463,7 +463,7 @@ describe("importSqliteDataToFuma", () => { await heldReader.execute("BEGIN"); await heldReader.execute("SELECT * FROM source"); - const tables = collectTables([]); + const tables = collectTables(); const result = await importLegacySqliteIfNeeded({ storage: { dataDir: workDir, @@ -509,7 +509,7 @@ describe("importSqliteDataToFuma", () => { .run("scope_a", "late_1", "from-backup"); legacy.close(); - const firstTables = collectTables([]); + const firstTables = collectTables(); const firstResult = await importLegacySqliteIfNeeded({ storage: { dataDir: workDir, @@ -522,7 +522,7 @@ describe("importSqliteDataToFuma", () => { expect(firstResult.importedTables).not.toContain("late_item"); const allTables: FumaTables = { - ...collectTables([]), + ...collectTables(), ...lateSchema, }; const secondResult = await importLegacySqliteIfNeeded({ @@ -561,13 +561,13 @@ describe("importSqliteDataToFuma", () => { sqlitePath, importMarkerPath: markerPath, }, - tables: collectTables([]), + tables: collectTables(), scopeId: "scope_a", }); expect(firstResult.importedTables).not.toContain("late_item"); const allTables: FumaTables = { - ...collectTables([]), + ...collectTables(), ...lateSchema, }; const secondResult = await importLegacySqliteIfNeeded({ diff --git a/apps/local/src/executor.ts b/apps/local/src/executor.ts index 265a905a7..40091ab71 100644 --- a/apps/local/src/executor.ts +++ b/apps/local/src/executor.ts @@ -677,7 +677,7 @@ const createLocalExecutorLayer = () => { Effect.gen(function* () { const { cwd, plugins } = yield* loadLocalPlugins; const scopeId = makeScopeId(cwd); - const tables = collectTables(plugins); + const tables = collectTables(); const importResult = yield* Effect.tryPromise({ try: () => diff --git a/apps/local/src/mcp-browser-resume.test.ts b/apps/local/src/mcp-browser-resume.test.ts index 8b092cfa4..cd79d3a79 100644 --- a/apps/local/src/mcp-browser-resume.test.ts +++ b/apps/local/src/mcp-browser-resume.test.ts @@ -79,7 +79,7 @@ const approvalPlugin = definePlugin(() => ({ const makeExecutor = async (tmpDir: string): Promise => { const plugins = [approvalPlugin()] as const; const sqlite = await createSqliteFumaDb({ - tables: collectTables(plugins), + tables: collectTables(), namespace: "executor_local_browser_resume_test", path: join(tmpDir, "data.db"), }); diff --git a/apps/local/src/mcp-oauth.test.ts b/apps/local/src/mcp-oauth.test.ts index ec095b1cd..67e02d410 100644 --- a/apps/local/src/mcp-oauth.test.ts +++ b/apps/local/src/mcp-oauth.test.ts @@ -74,7 +74,7 @@ const startHarness = async (tmpDir: string): Promise => { fileSecretsPlugin({ directory: tmpDir }), ] as const; const sqlite = await createSqliteFumaDb({ - tables: collectTables(plugins), + tables: collectTables(), namespace: "executor_local_test", path: join(tmpDir, "data.db"), }); diff --git a/packages/core/cli/src/commands/schema.ts b/packages/core/cli/src/commands/schema.ts index fdc15a2c8..261f7139e 100644 --- a/packages/core/cli/src/commands/schema.ts +++ b/packages/core/cli/src/commands/schema.ts @@ -3,11 +3,13 @@ import fs from "node:fs/promises"; import path from "node:path"; import { Command } from "commander"; import { collectTables } from "@executor-js/sdk/core"; -import { getConfig } from "../utils/get-config.js"; + +// The executor's table set is fixed and plugin-independent (`collectTables()`), +// so schema generation needs no `executor.config.ts` — only the target ORM +// namespace/adapter/provider. The same tables render per database via flags. type SchemaGenerateOptions = { readonly cwd: string; - readonly config?: string; readonly output?: string; readonly namespace: string; readonly adapter: string; @@ -22,14 +24,6 @@ const schemaGenerateAction = async (opts: SchemaGenerateOptions) => { process.exit(1); } - const config = await getConfig({ cwd, configPath: opts.config }); - if (!config) { - console.error( - "No configuration file found. Add an `executor.config.ts` file to " + - "your project or pass the path using the `--config` flag.", - ); - process.exit(1); - } if (opts.adapter !== "drizzle") { console.error(`Unsupported schema adapter "${opts.adapter}". Supported adapters: drizzle.`); process.exit(1); @@ -49,7 +43,7 @@ const schemaGenerateAction = async (opts: SchemaGenerateOptions) => { const schema = fumaSchema({ version: opts.version, - tables: collectTables(config.plugins()), + tables: collectTables(), }); const factory = fumadb({ namespace: opts.namespace, @@ -75,9 +69,8 @@ export const schema = new Command("schema") .description("Database schema utilities") .addCommand( new Command("generate") - .description("Generate an ORM schema file from the executor config") + .description("Generate the ORM schema file for the executor's fixed table set") .option("-c, --cwd ", "the working directory", process.cwd()) - .option("--config ", "path to the executor config file") .option("--output ", "output file path for the generated schema") .option("--namespace ", "FumaDB namespace", "executor") .option("--adapter ", "FumaDB adapter", "drizzle") diff --git a/packages/core/sdk/src/executor.ts b/packages/core/sdk/src/executor.ts index b79c9d021..05caea8e4 100644 --- a/packages/core/sdk/src/executor.ts +++ b/packages/core/sdk/src/executor.ts @@ -447,10 +447,10 @@ export interface ExecutorConfig { +export const collectTables = (): FumaTables => { validateExecutorScopePolicyTables(coreSchema); return { ...coreSchema }; }; @@ -494,7 +494,7 @@ const createDefaultMemoryDb = (tables: FumaTables): ExecutorDb => { schemas: [latestSchema], }); - // oxlint-disable-next-line executor/no-double-cast -- boundary: dynamic plugin table map is known only after collectTables() + // oxlint-disable-next-line executor/no-double-cast -- boundary: fumadb's generic ORM client type doesn't structurally match the FumaDb facade const db = factory.client(memoryAdapter()).orm(version) as unknown as FumaDb; return { db, @@ -1360,7 +1360,7 @@ export const createExecutor = collectTables(plugins), + try: () => collectTables(), catch: (cause) => storageFailureFromUnknown("Failed to collect executor tables", cause), }); const dbInput = yield* Effect.suspend(() => { diff --git a/packages/core/sdk/src/promise-executor.ts b/packages/core/sdk/src/promise-executor.ts index e420b7e5d..debaf6f2c 100644 --- a/packages/core/sdk/src/promise-executor.ts +++ b/packages/core/sdk/src/promise-executor.ts @@ -94,9 +94,9 @@ export interface ExecutorConfig> => { const plugins = (config?.plugins ?? []) as TPlugins; const db = - typeof config.db === "function" - ? await config.db({ tables: collectTables(plugins) }) - : config.db; + typeof config.db === "function" ? await config.db({ tables: collectTables() }) : config.db; const scopes = config.scopes && config.scopes.length > 0 diff --git a/packages/core/sdk/src/scope-policy.test.ts b/packages/core/sdk/src/scope-policy.test.ts index 49b56e6ad..e45615443 100644 --- a/packages/core/sdk/src/scope-policy.test.ts +++ b/packages/core/sdk/src/scope-policy.test.ts @@ -74,7 +74,7 @@ describe("executor FumaDB scope policy", () => { Effect.promise(() => createSqliteTestFumaDb({ tables: { - ...collectTables([]), + ...collectTables(), ...unscopedSchema, }, namespace: "executor_unscoped_test", @@ -102,7 +102,7 @@ describe("executor FumaDB scope policy", () => { Effect.promise(() => createSqliteTestFumaDb({ tables: { - ...collectTables([]), + ...collectTables(), ...incompletePolicySchema, }, namespace: "executor_incomplete_policy_test", diff --git a/packages/core/sdk/src/test-config.ts b/packages/core/sdk/src/test-config.ts index 1b5e479de..7cf21ebc6 100644 --- a/packages/core/sdk/src/test-config.ts +++ b/packages/core/sdk/src/test-config.ts @@ -126,7 +126,7 @@ export const makeTestConfig = /@id/virtual:tanstack-start-client-entry +// TypeError: Cannot read properties of undefined (reading 'has') +// +// …with a swarm of `net::ERR_ABORTED` on in-flight module requests. +// +// Root cause: that is Vite's *cold-start dependency re-optimization reload*. The +// first load after the import graph changes makes Vite re-bundle a late-discovered +// dep and force a full page reload, which aborts the in-flight client-entry import. +// It self-heals on the next load (hydration then succeeds). So the warm-up +// navigation below deliberately absorbs that benign one-time reload; the MEASURED +// navigation must then come up clean. +// +// What this guards against is the *persistent* version: the client entry failing +// to load on a settled server, leaving the app permanently dead. That is invisible +// to a request-level test (every module serves a clean 200 to `curl`) — it only +// surfaces in a browser running the module graph. Hence Playwright, booted by +// playwright.config.ts's webServer against a stub-env Vite dev + throwaway PGlite. +// --------------------------------------------------------------------------- + +// Only Vite's own dev module-graph URLs — the client entry and everything it +// statically/dynamically imports. Deliberately excludes third-party scripts +// (e.g. analytics under /api/a/static) that have their own, unrelated lifecycle. +const isViteModuleRequest = (url: string) => + url.includes("/@id/") || url.includes("/@fs/") || url.includes("/node_modules/.vite/"); + +test("the client entry hydrates — the SPA mounts, no dynamic-import failure", async ({ page }) => { + // Warm-up: the first cold load may trigger Vite's one-time dep re-optimize + + // reload. Swallow it here so the measured pass below sees a settled server. + await page.goto("/", { waitUntil: "load" }); + await page.waitForTimeout(1500); + + const fatal: string[] = []; + const abortedModules: string[] = []; + + // A persistent hydration failure surfaces as an unhandled rejection ("Failed to + // fetch dynamically imported module") and/or a thrown TypeError; capture both. + await page.addInitScript(() => { + window.addEventListener("unhandledrejection", (event) => { + console.error(`UNHANDLED_REJECTION: ${String(event.reason)}`); + }); + }); + page.on("console", (message) => { + const text = message.text(); + if ( + /failed to fetch dynamically imported module/i.test(text) || + /tanstack-start-client-entry/i.test(text) || + /UNHANDLED_REJECTION/i.test(text) + ) { + fatal.push(`[console.${message.type()}] ${text}`); + } + }); + page.on("pageerror", (error) => fatal.push(`[pageerror] ${String(error)}`)); + page.on("requestfailed", (request) => { + const failure = request.failure()?.errorText ?? ""; + if (/ERR_ABORTED/i.test(failure) && isViteModuleRequest(request.url())) { + abortedModules.push(`${failure} ${request.url()}`); + } + }); + + // Measured pass against the now-settled server. + await page.goto("/", { waitUntil: "load" }); + await page.waitForTimeout(2500); + + // The SSR shell always carries the title; that alone does NOT prove hydration. + await expect(page).toHaveTitle(/Executor/i); + + // (1) No dynamic-import / hydration crash. + expect(fatal, `client-entry/hydration errors:\n${fatal.join("\n")}`).toEqual([]); + + // (2) No aborted module fetches — the signature of the client entry failing to + // load (a stuck re-optimize, a boundary leak, a broken transform). + expect( + abortedModules, + `module requests were aborted (client entry did not load cleanly):\n${abortedModules.join("\n")}`, + ).toEqual([]); + + // (3) The client runtime actually booted: TanStack Start/Router installs its + // router on `window` during hydration. This is true regardless of auth state + // (the stub session is unauthenticated, so there's little rendered text to + // assert on — but a mounted client always exposes the router). + const hydrated = await page.evaluate( + () => Reflect.has(window, "__TSR_ROUTER__") || Reflect.has(window, "__TSR__"), + ); + expect(hydrated, "TanStack Start router never mounted — the SPA did not hydrate").toBe(true); +}); diff --git a/apps/cloud/e2e/e2e-server.ts b/apps/cloud/e2e/e2e-server.ts new file mode 100644 index 000000000..823e394aa --- /dev/null +++ b/apps/cloud/e2e/e2e-server.ts @@ -0,0 +1,67 @@ +// --------------------------------------------------------------------------- +// Boots the cloud app's Vite dev server for the Playwright e2e suite — the SAME +// dev stack a developer runs (`bun run dev`), minus 1Password / real WorkOS. +// +// Everything here is a STUB: fake WorkOS creds, a fixed cookie/encryption key, +// and a throwaway PGlite on its own port (so it never collides with a running +// `bun dev`). That's deliberate — what the spec guards (the TanStack Start client +// entry hydrating) is a CLIENT-side module-graph concern that doesn't depend on +// any of these values, so the stub config is sufficient and the harness stays +// runnable in CI with no secrets. +// +// Used by `playwright.config.ts`'s `webServer`. Spawns the dev DB + Vite, wires +// their stdout through, and tears both down on exit. +// --------------------------------------------------------------------------- + +import { spawn, type ChildProcess } from "node:child_process"; +import { dirname, resolve } from "node:path"; +import { fileURLToPath } from "node:url"; + +const appDir = resolve(dirname(fileURLToPath(import.meta.url)), ".."); + +const PORT = process.env.E2E_PORT ?? "4798"; +const DB_PORT = process.env.E2E_DB_PORT ?? "5435"; +const ORIGIN = `http://127.0.0.1:${PORT}`; + +const stubEnv: NodeJS.ProcessEnv = { + ...process.env, + // WorkOS — never contacted during the hydration path; just has to be present. + WORKOS_API_KEY: "sk_e2e_stub", + WORKOS_CLIENT_ID: "client_e2e_stub", + WORKOS_COOKIE_PASSWORD: "e2e_cookie_password_0123456789abcdef0123456789abcdef", + AUTUMN_SECRET_KEY: "am_e2e_stub", + // 32-byte hex at-rest key (only used lazily on secret writes, not on render). + ENCRYPTION_KEY: "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef", + // Direct connection to the throwaway PGlite (no Hyperdrive in dev). + DATABASE_URL: `postgresql://postgres:postgres@127.0.0.1:${DB_PORT}/postgres`, + EXECUTOR_DIRECT_DATABASE_URL: "true", + CLOUDFLARE_INCLUDE_PROCESS_ENV: "true", + VITE_PUBLIC_SITE_URL: ORIGIN, + MCP_AUTHKIT_DOMAIN: "https://example.com", + MCP_RESOURCE_ORIGIN: ORIGIN, + // Throwaway dev DB on its own port + dir so it never fights a running `bun dev`. + DEV_DB_PORT: DB_PORT, + DEV_DB_PATH: resolve(appDir, ".e2e-db"), +}; + +const children: ChildProcess[] = []; +const start = (cmd: string, args: string[]) => { + const child = spawn(cmd, args, { cwd: appDir, env: stubEnv, stdio: "inherit" }); + child.on("exit", (code) => { + // If either process dies, take the whole harness down so Playwright fails fast. + if (code !== 0 && code !== null) { + shutdown(code); + } + }); + children.push(child); +}; + +const shutdown = (code = 0) => { + for (const child of children) child.kill("SIGTERM"); + process.exit(code); +}; +process.on("SIGINT", () => shutdown(0)); +process.on("SIGTERM", () => shutdown(0)); + +start("bun", ["run", "scripts/dev-db.ts"]); +start("bunx", ["vite", "dev", "--port", PORT, "--strictPort", "--host", "127.0.0.1"]); diff --git a/apps/cloud/package.json b/apps/cloud/package.json index aa88eb60f..3d927d01c 100644 --- a/apps/cloud/package.json +++ b/apps/cloud/package.json @@ -22,6 +22,7 @@ "test": "node ../../node_modules/vitest/vitest.mjs run && node ../../node_modules/vitest/vitest.mjs run --config vitest.node.config.ts", "test:watch": "node ../../node_modules/vitest/vitest.mjs", "test:node": "node ../../node_modules/vitest/vitest.mjs run --config vitest.node.config.ts", + "test:e2e": "playwright test", "typecheck:slow": "tsc --noEmit" }, "dependencies": { @@ -75,6 +76,7 @@ "@electric-sql/pglite": "^0.4.4", "@electric-sql/pglite-socket": "^0.1.4", "@executor-js/cli": "workspace:*", + "@playwright/test": "^1.60.0", "@rhyssul/portless": "^0.13.0", "@tailwindcss/vite": "catalog:", "@types/react": "catalog:", @@ -83,6 +85,7 @@ "concurrently": "^9.2.1", "drizzle-kit": "catalog:", "jiti": "^2.6.1", + "playwright": "^1.60.0", "typescript": "catalog:", "vite": "catalog:", "vitest": "^4.1.5", diff --git a/apps/cloud/playwright.config.ts b/apps/cloud/playwright.config.ts new file mode 100644 index 000000000..ec7a55191 --- /dev/null +++ b/apps/cloud/playwright.config.ts @@ -0,0 +1,49 @@ +import { defineConfig, devices } from "@playwright/test"; + +// --------------------------------------------------------------------------- +// Playwright e2e for the cloud app. Boots the real Vite dev server (stub env, +// throwaway PGlite — see e2e/e2e-server.ts) and drives it in a real browser, so +// failures that only surface during client hydration (the TanStack Start client +// entry not loading) are caught. The Vitest suites can't see these — they exercise +// the HTTP handler, not the browser module graph. +// --------------------------------------------------------------------------- + +const PORT = 4798; +const BASE_URL = `http://127.0.0.1:${PORT}`; + +export default defineConfig({ + testDir: "./e2e", + testMatch: "**/*.spec.ts", + // One dev server; keep it serial + non-parallel so the assertions are stable. + fullyParallel: false, + workers: 1, + forbidOnly: !!process.env.CI, + retries: 0, + reporter: process.env.CI ? "github" : "list", + timeout: 60_000, + expect: { timeout: 15_000 }, + use: { + baseURL: BASE_URL, + headless: true, + ignoreHTTPSErrors: true, + trace: "retain-on-failure", + }, + projects: [ + { + name: "chromium", + // Drive the system Chrome by default (no Chromium download needed); CI sets + // PLAYWRIGHT_USE_CHROMIUM=1 to use the Playwright-managed browser instead. + use: process.env.PLAYWRIGHT_USE_CHROMIUM + ? { ...devices["Desktop Chrome"] } + : { ...devices["Desktop Chrome"], channel: "chrome" }, + }, + ], + webServer: { + command: "bun run e2e/e2e-server.ts", + url: BASE_URL, + timeout: 120_000, + reuseExistingServer: !process.env.CI, + stdout: "pipe", + stderr: "pipe", + }, +}); diff --git a/apps/cloud/scripts/dev-db.ts b/apps/cloud/scripts/dev-db.ts index 5da4cea86..39b01d66d 100644 --- a/apps/cloud/scripts/dev-db.ts +++ b/apps/cloud/scripts/dev-db.ts @@ -17,8 +17,12 @@ import { drizzle } from "drizzle-orm/pglite"; import { migrate } from "drizzle-orm/pglite/migrator"; const __dirname = dirname(fileURLToPath(import.meta.url)); -const PORT = 5433; -const DB_PATH = resolve(__dirname, "../.dev-db"); +// Port + data dir default to the dev values but are env-overridable so a second +// throwaway instance (e.g. the Playwright e2e harness) can run alongside `bun dev`. +const PORT = Number(process.env.DEV_DB_PORT ?? 5433); +const DB_PATH = process.env.DEV_DB_PATH + ? resolve(process.env.DEV_DB_PATH) + : resolve(__dirname, "../.dev-db"); const MIGRATIONS_FOLDER = resolve(__dirname, "../drizzle"); // Reap any orphan dev-db from a previous `bun dev` that didn't shut down diff --git a/bun.lock b/bun.lock index 8e1a6d1b7..6207f90d3 100644 --- a/bun.lock +++ b/bun.lock @@ -105,6 +105,7 @@ "@electric-sql/pglite": "^0.4.4", "@electric-sql/pglite-socket": "^0.1.4", "@executor-js/cli": "workspace:*", + "@playwright/test": "^1.60.0", "@rhyssul/portless": "^0.13.0", "@tailwindcss/vite": "catalog:", "@types/react": "catalog:", @@ -113,6 +114,7 @@ "concurrently": "^9.2.1", "drizzle-kit": "catalog:", "jiti": "^2.6.1", + "playwright": "^1.60.0", "typescript": "catalog:", "vite": "catalog:", "vitest": "^4.1.5", @@ -1984,6 +1986,8 @@ "@pkgjs/parseargs": ["@pkgjs/parseargs@0.11.0", "", {}, "sha512-+1VkjdD0QBLPodGrJUeqarH8VAIvQODIbwh9XpP5Syisf7YoQgsJKPNFoqqLQlu+VQ/tVSshMR6loPMn8U+dPg=="], + "@playwright/test": ["@playwright/test@1.60.0", "", { "dependencies": { "playwright": "1.60.0" }, "bin": { "playwright": "cli.js" } }, "sha512-O71yZIbAh/PxDMNGns37GHBIfrVkEVyn+AXyIa5dOTfb4/xNvRWV+Vv/NMbNCtODB/pO7vLlF2OTmMVLhmr7Ag=="], + "@poppinss/colors": ["@poppinss/colors@4.1.6", "", { "dependencies": { "kleur": "^4.1.5" } }, "sha512-H9xkIdFswbS8n1d6vmRd8+c10t2Qe+rZITbbDHHkQixH5+2x1FDGmi/0K+WgWiqQFKPSlIYB7jlH6Kpfn6Fleg=="], "@poppinss/dumper": ["@poppinss/dumper@0.6.5", "", { "dependencies": { "@poppinss/colors": "^4.1.5", "@sindresorhus/is": "^7.0.2", "supports-color": "^10.0.0" } }, "sha512-NBdYIb90J7LfOI32dOewKI1r7wnkiH6m920puQ3qHUeZkxNkQiFnXVWoE6YtFSv6QOiPPf7ys6i+HWWecDz7sw=="], @@ -4184,6 +4188,10 @@ "pkg-types": ["pkg-types@1.3.1", "", { "dependencies": { "confbox": "^0.1.8", "mlly": "^1.7.4", "pathe": "^2.0.1" } }, "sha512-/Jm5M4RvtBFVkKWRu2BLUTNP8/M2a+UwuAX+ae4770q1qVGtfjG+WTCupoZixokjmHiry8uI+dlY8KXYV5HVVQ=="], + "playwright": ["playwright@1.60.0", "", { "dependencies": { "playwright-core": "1.60.0" }, "optionalDependencies": { "fsevents": "2.3.2" }, "bin": { "playwright": "cli.js" } }, "sha512-hheHdokM8cdqCb0lcE3s+zT4t4W+vvjpGxsZlDnikarzx8tSzMebh3UiFtgqwFwnTnjYQcsyMF8ei2mCO/tpeA=="], + + "playwright-core": ["playwright-core@1.60.0", "", { "bin": { "playwright-core": "cli.js" } }, "sha512-9bW6zvX/m0lEbgTKJ6YppOKx8H3VOPBMOCFh2irXFOT4BbHgrx5hPjwJYLT40Lu+4qtD36qKc/Hn56StUW57IA=="], + "plist": ["plist@3.1.0", "", { "dependencies": { "@xmldom/xmldom": "^0.8.8", "base64-js": "^1.5.1", "xmlbuilder": "^15.1.1" } }, "sha512-uysumyrvkUX0rX/dEVqt8gC3sTBzd4zoWfLeS29nb53imdaXVvLINYXTI2GNqzaMuvacNx4uJQ8+b3zXR0pkgQ=="], "points-on-curve": ["points-on-curve@0.2.0", "", {}, "sha512-0mYKnYYe9ZcqMCWhUjItv/oHjvgEsfKvnUTg8sAtnHr3GVy7rGkXCb6d5cSyqrWqL4k81b9CPg3urd+T7aop3A=="], @@ -5436,6 +5444,8 @@ "parse5/entities": ["entities@6.0.1", "", {}, "sha512-aN97NXWF6AWBTahfVOIrB/NShkzi5H7F9r1s9mD3cDj4Ko5f2qhhVoYMibXF7GlLveb/D2ioWay8lxI97Ven3g=="], + "playwright/fsevents": ["fsevents@2.3.2", "", { "os": "darwin" }, "sha512-xiqMQR4xAeHTuB9uWm+fFRcIOgKBMiOBP+eXiyT7jsgVCq1bkVygt00oASowB7EdtpOHaaPgKt812P9ab+DDKA=="], + "postcss/nanoid": ["nanoid@3.3.11", "", { "bin": { "nanoid": "bin/nanoid.cjs" } }, "sha512-N8SpfPUnUp1bK+PMYW8qSWdl9U+wwNWI4QKxOYDy9JAro3WMX7p2OeVRF9v+347pnakNevPmiHhNmZ2HbFA76w=="], "posthog-js/@opentelemetry/api-logs": ["@opentelemetry/api-logs@0.208.0", "", { "dependencies": { "@opentelemetry/api": "^1.3.0" } }, "sha512-CjruKY9V6NMssL/T1kAFgzosF1v9o6oeN+aX5JB/C/xPNtmgIJqcXHG7fA82Ou1zCpWGl4lROQUKwUNE1pMCyg=="],