Function makeSelfHostApp

apps/host-selfhost/src/app.ts:58–180

(options: MakeSelfHostAppOptions = {})

}

export const makeSelfHostApp = async (options: MakeSelfHostAppOptions = {}) => {
  const config = loadConfig();

  // ---- eager async boot: the shared libSQL handle -----------------------
  const dbHandle = await createSelfHostDb({
    path: options.dbPath ?? config.dbPath,
    namespace: SELF_HOST_NAMESPACE,
    version: SELF_HOST_SCHEMA_VERSION,
  });

  // Boot-time data migrations: each registry entry runs once and is stamped
  // in the `data_migration` ledger; stamped entries are skipped without
  // touching the data.
  await Effect.runPromise(runSqliteDataMigrations(dbHandle.client, selfHostDataMigrations));

  // ---- auth providers ---------------------------------------------------
  // Better Auth: cookie/bearer/api-key identity + /api/auth handler + account
  // API + MCP OAuth seam, all over the shared libSQL handle.
  const { identityLayer, authHandler, betterAuth } = await resolveAuthProviders(dbHandle);

  // ---- the in-process MCP serving seams (+ shutdown hook) ----------------
  // Pass the pinned public origin so browser-approval URLs are reachable behind
  // a reverse proxy (not the internal 127.0.0.1 bind from the request URL).
  const mcp = makeSelfHostMcpSeams(
    dbHandle,
    betterAuth,
    config.webBaseUrl,
    config.mcp20260728Enabled,
  );

  // CLI device-login discovery (`executor login`). Points the CLI at Better
  // Auth's device endpoints; `requestFormat: "json"` because those endpoints
  // only accept JSON (unlike WorkOS's form-encoded ones). The issued token is a
  // Better Auth session that `bearer()` accepts on the /api/* plane.
  const cliLoginHandler = HttpEffect.fromWebHandler(
    async () =>
      new Response(
        JSON.stringify({
          provider: "better-auth",
          deviceAuthorizationEndpoint: `${config.webBaseUrl}/api/auth/device/code`,
          tokenEndpoint: `${config.webBaseUrl}/api/auth/device/token`,
          clientId: "executor-cli",
          requestFormat: "json",
        }),
        { headers: { "content-type": "application/json" } },
      ),
  );

  const { appLayer, toWebHandler } = ExecutorApp.make({
    plugins: selfHostPlugins,
    providers: {
      identity: identityLayer,
      account: selfHostAccountMiddleware(betterAuth),
      db: SelfHostDbProvider,
      engine: {
        codeExecutor: SelfHostCodeExecutorProvider,
        // Anonymous execution analytics (this seam is the HTTP plane; the MCP
        // plane's decorator is wired in mcp/session-store.ts's stack layer).