import { Effect, Layer } from "effect"; import { IdentityProvider } from "@executor-js/api/server";import type {  McpAuthProvider,  McpErrorReporter,  McpSessionStore,  Principal,} from "@executor-js/host-mcp"; import { BetterAuth, type BetterAuthHandle } from "../auth/better-auth";import type { SelfHostDbHandle } from "../db/self-host-db";import { selfHostMcpAuth } from "./auth";import {  makeSelfHostMcpSessionStore,  selfHostMcpReporter,  selfHostMcpSessions,} from "./session-store"; export { selfHostMcpAuth } from "./auth";export {  makeSelfHostMcpSessionStore,  selfHostMcpReporter,  selfHostMcpSessions,  McpEngineBuildError,} from "./session-store"; // ---------------------------------------------------------------------------// The self-host MCP serving seams, fed to `ExecutorApp.make`'s `mcp` group.//// `ExecutorApp.make` mounts the shared, provider-neutral MCP serving envelope// from @executor-js/host-mcp (the two root OAuth discovery docs + the multi-user// /mcp endpoint, top-level per the ecosystem convention). The envelope does its// own auth + session handling and is mounted OUTSIDE the API's execution// middleware, like /api/auth.//// Self-host provides the TWO envelope seams plus an error-reporter override://   - McpAuthProvider  -> `selfHostMcpAuth` (Better Auth mcp() OAuth). It still//                         requires `IdentityProvider`, which `make` provides from//                         the resolved identity seam.//   - McpSessionStore  -> `selfHostMcpSessions`: in-process Map. The store owns//                         dispatch (create + forward + ownership) and builds its//                         engine internally over the shared SelfHostDb.//   - McpErrorReporter -> `selfHostMcpReporter`: route 500 defects through the//                         host's console capture.//// The OAuth endpoints (/api/auth/mcp/{register,authorize,token}) stay on the// Better Auth handler mounted at /api/auth — not in the envelope.// --------------------------------------------------------------------------- export interface SelfHostMcpSeams {  /** Resolve a request to an MCP `AuthOutcome` + declare the discovery routes. */  readonly auth: Layer.Layer<McpAuthProvider, never, IdentityProvider>;  /** The in-process session store seam (dispatch + lifetime). */  readonly sessions: Layer.Layer<McpSessionStore>;  /** Route 500 defects through the host's console `ErrorCapture`. */  readonly reporter: Layer.Layer<McpErrorReporter>;  /**   * The browser-approval HTTP handler, mounted by the app at   * `/api/mcp-sessions/*`: a session-cookie-gated web handler that serves the   * paused-execution detail (GET) and records the human's decision (POST   * `/resume`) for the console approval page. Browser elicitation mode only.   */  readonly approvalHandler: (request: Request) => Promise<Response>;  /** Dispose all live in-process MCP sessions at shutdown (not a seam). */  readonly close: () => Promise<void>;} const jsonResponse = (value: unknown, status: number): Response =>  new Response(JSON.stringify(value), { status, headers: { "content-type": "application/json" } }); const parseRoles = (role: string | null | undefined): ReadonlyArray<string> =>  (role ?? "user")    .split(",")    .map((r) => r.trim())    .filter((r) => r.length > 0); type BetterAuthSession = NonNullable<  Awaited<ReturnType<BetterAuthHandle["auth"]["api"]["getSession"]>>>; const principalFromSession = (  resolved: BetterAuthSession,  betterAuth: BetterAuthHandle,): Principal => ({  accountId: resolved.user.id,  organizationId: resolved.session.activeOrganizationId ?? betterAuth.organizationId,  organizationName: betterAuth.organizationName,  email: resolved.user.email,  name: resolved.user.name ?? null,  avatarUrl: resolved.user.image ?? null,  roles: parseRoles(resolved.user.role ?? null),}); /** * Gate the browser-approval endpoints behind a valid Better Auth session (the * console page calls them with the user's cookie), then delegate to the * in-process store's paused/resume handlers with the resolved principal so the * store can enforce MCP session ownership before exposing or recording a * browser-approval decision. */const makeApprovalHandler =  (    store: ReturnType<typeof makeSelfHostMcpSessionStore>,    betterAuth: BetterAuthHandle,  ): ((request: Request) => Promise<Response>) =>  async (request) => {    // A malformed cookie must read as unauthenticated, not 500.    const session = await Effect.runPromise(      Effect.tryPromise({        try: () => betterAuth.auth.api.getSession({ headers: request.headers }),        catch: () => "session lookup failed",      }).pipe(Effect.orElseSucceed(() => null)),    );    if (!session) return jsonResponse({ error: "Unauthorized" }, 401);    const principal = principalFromSession(session, betterAuth);     return (      (await store.handlePausedRequest(request, principal)) ??      (await store.handleApprovalRequest(request, principal)) ??      jsonResponse({ error: "Not found" }, 404)    );  }; /** * Build the self-host MCP serving seams over the long-lived DB handle. The auth * seam is `selfHostMcpAuth` (Better Auth mcp() OAuth), with the Better Auth * instance provided; it still requires `IdentityProvider` from the resolved * identity seam. Returns the three seam Layers plus the `close()` lifetime hook * the app wires into shutdown. */export const makeSelfHostMcpSeams = (  dbHandle: SelfHostDbHandle,  betterAuth: BetterAuthHandle,  webBaseUrl?: string,): SelfHostMcpSeams => {  const sessionStore = makeSelfHostMcpSessionStore(dbHandle, webBaseUrl);  const auth: Layer.Layer<McpAuthProvider, never, IdentityProvider> = selfHostMcpAuth.pipe(    Layer.provide(Layer.succeed(BetterAuth)(betterAuth)),  );  return {    auth,    sessions: selfHostMcpSessions(sessionStore),    reporter: selfHostMcpReporter,    approvalHandler: makeApprovalHandler(sessionStore, betterAuth),    close: sessionStore.close,  };};