Serve an API with owned sessions

import { pathToFileURL } from "node:url";
import express from "express";
import { Agent, openai, type ModelProvider } from "@agentium/core";
import { createAgentRouter } from "@agentium/transport";
import { z } from "zod";

const identitySchema = z.object({ userId: z.string(), tenantId: z.string() });
// Known demonstration credentials; bind this example only to loopback.
const users = new Map([
  ["Bearer docs-alice", { userId: "alice", tenantId: "demo" }],
  ["Bearer docs-bob", { userId: "bob", tenantId: "demo" }],
]);
const fixture: ModelProvider = {
  providerId: "fixture", modelId: "support",
  async generate() {
    return { message: { role: "assistant", content: "Please share your order ID." },
      finishReason: "stop", raw: null, usage: { promptTokens: 10, completionTokens: 5, totalTokens: 15 } };
  },
  async *stream() { throw new Error("Use the /run endpoint for this fixture"); },
};

export async function startSupportAPI(port = 3100, model: ModelProvider = fixture) {
  const support = new Agent({
    name: "support", model, register: false,
    instructions: "Help with orders. Ask for an order ID when one is missing.",
  });
  const owners = new Map<string, string>();
  const app = express();
  app.use(express.json({ limit: "16kb" }));
  app.use((req, _res, next) => {
    const identity = users.get(req.get("authorization") ?? "");
    if (identity) Object.assign(req, { user: identity });
    next();
  });
  app.use("/api", createAgentRouter({
    registry: false, agents: { support },
    security: {
      mode: "authenticated",
      resolveIdentity: (claims) => {
        const parsed = identitySchema.safeParse(claims);
        return parsed.success ? parsed.data : null;
      },
      authorizeResource: ({ identity, operation, resource }) => {
        if (resource.kind !== "session" || resource.agentName !== "support" || !resource.id) return false;
        const owner = JSON.stringify([identity.tenantId, identity.userId]);
        if (operation === "session:create") {
          if (owners.has(resource.id)) return false;
          owners.set(resource.id, owner); // Atomic within this one synchronous process.
          return true;
        }
        return operation === "session:use" && owners.get(resource.id) === owner;
      },
    },
  }));
  const server = app.listen(port, "127.0.0.1");
  try {
    await new Promise<void>((resolve, reject) => {
      server.once("listening", resolve);
      server.once("error", reject);
    });
  } catch (error) { await support.close(); throw error; }
  const address = server.address();
  if (!address || typeof address === "string") throw new Error("Expected a TCP listener");
  const url = `http://127.0.0.1:${address.port}/api/agents/support/run`;
  let closing: Promise<void> | undefined;
  function close() {
    return closing ??= new Promise<void>((resolve, reject) => {
      server.close((error) => error ? reject(error) : resolve());
    }).finally(() => support.close());
  }
  return { url, close };
}

if (process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href) {
  const live = process.argv.includes("--live");
  if (live && !process.env.OPENAI_API_KEY) throw new Error("Set OPENAI_API_KEY before using --live");
  const api = await startSupportAPI(3100, live ? openai(process.env.OPENAI_MODEL ?? "gpt-6-luna") : fixture);
  console.log("Support API:", api.url);
  const shutdown = () => { void api.close().catch((error) => { console.error(error); process.exitCode = 1; }); };
  process.once("SIGINT", shutdown);
  process.once("SIGTERM", shutdown);
}