import { Effect } from "effect"; import {  makeSelfHostApps,  BindingError,  connectionNameForScope,  type ClientResolver,  type SelfHostApps,} from "@executor-js/plugin-apps/api"; import { resolveDataDir } from "./config";import { makeCtxResolver } from "./apps-resolver"; // ---------------------------------------------------------------------------// Self-host wiring for the apps subsystem.//// The apps subsystem (packages/plugins/apps) owns custom tools, durable// workflows, ui views and skills behind five substrate-neutral seams. This// module builds it ONCE (a boot-time singleton) so the SAME runtime is shared// by (a) the source plugin added to the executor plugin list in// executor.config.ts, so published tools are real catalog citizens, (b) the// MCP registration on the real MCP server, and (c) the HTTP surface. `plugins()`// runs per request and re-instantiates the plugin, but every instance closes// over this one runtime, so there is one published-descriptor store, one// journal, one scheduler across the process.//// The `ClientResolver` is the one seam that reaches real integrations (the// platform invoke path: credentials, policy, audit). Threading it through the// executor catalog requires per-request executor context that the boot-time// singleton does not hold; the running server ships a resolver that fails with// a typed NotImplemented for external calls, while the scope-database path// (`db.sql`) is fully live. See the note in DESIGN / the remaining-gap section.// The full real external-call path is exercised end-to-end in the package e2e// and the booted-host wire e2e against the emulate GitHub.// --------------------------------------------------------------------------- /** The single scope this self-host instance serves (single-tenant). */export const SELF_HOST_SCOPE = "default"; /** The apps connection name for the self-host scope (formalized mapping). */export const SELF_HOST_APPS_CONNECTION = connectionNameForScope(SELF_HOST_SCOPE); const notImplementedResolver: ClientResolver = {  call: ({ integration }) =>    Effect.fail(      new BindingError({        message:          `external integration "${integration}" routing is not wired into the running self-host ` +          `server yet (the ClientResolver -> catalog bridge needs per-request executor context). ` +          `Scope-database tools work; see the apps package e2e for the full external-call path.`,        role: integration,        surface: integration,      }),    ),}; /** Options for the apps subsystem singleton. `authenticate` gates the HTTP *  surface; supplied by `app.ts` from the resolved Better Auth instance. *  `webBaseUrl` is the public origin used to build the `apps_open_ui` HTTP *  fallback URL. */export interface SelfHostAppsSubsystemOptions {  readonly authenticate?: (request: Request) => Promise<boolean>;  readonly webBaseUrl?: string;} // The boot-time singleton. Built lazily on first access so importing this module// (which executor.config.ts does) does not do filesystem work at import time.let subsystem: SelfHostApps | undefined; // The live authenticate + fallback-URL refs. The subsystem is a singleton and is// FIRST built by executor.config.ts (which has no auth), then app.ts calls again// WITH auth. So we can't bake auth into the http handler at build time — instead// the handler reads these mutable refs per request, and app.ts sets them once the// Better Auth instance is resolved. Until set, the surface DENIES all requests// (fail-closed), so a misconfigured boot never exposes the surface unauthed.let authenticateRef: ((request: Request) => Promise<boolean>) | undefined;let webBaseUrlRef: string | undefined; export const getSelfHostAppsSubsystem = (  options: SelfHostAppsSubsystemOptions = {},): SelfHostApps => {  // Apply any newly-supplied config to the live refs (app.ts's call carries the  // real auth even though config.ts built the singleton first).  if (options.authenticate) authenticateRef = options.authenticate;  if (options.webBaseUrl) webBaseUrlRef = options.webBaseUrl;   if (!subsystem) {    subsystem = makeSelfHostApps({      dataDir: resolveDataDir(),      // Boot-time fallback for calls made outside a request (e.g. the scheduler      // firing a workflow with no request ctx). The per-request `makeResolver`      // below is the real path for catalog-invoked tools.      resolver: notImplementedResolver,      scope: SELF_HOST_SCOPE,      // The REAL per-request resolver: built from the invoking executor context      // so external integration calls resolve the user's connection + credential      // at the boundary and dispatch over the request's HttpClient.      makeResolver: ({ ctx }) => makeCtxResolver(ctx),      // Read the live auth ref per request. Fail-closed: if app.ts hasn't wired      // the Better Auth check yet, deny (never expose the surface unauthed).      authenticate: (request) =>        authenticateRef ? authenticateRef(request) : Promise.resolve(false),      // Read the live web base URL ref (used for the apps_open_ui fallback URL).      webBaseUrl: undefined,      webBaseUrlFn: () => webBaseUrlRef,    });  }  return subsystem;}; /** Reset the singleton (tests build fresh instances per data dir). */export const resetSelfHostAppsSubsystem = (): void => {  subsystem = undefined;  authenticateRef = undefined;  webBaseUrlRef = undefined;}; /** @deprecated use getSelfHostAppsSubsystem(); kept for existing call sites. */export const makeSelfHostAppsSubsystem = getSelfHostAppsSubsystem;