blockchain/apps/portal/app/api/briven/machine-status/route.ts

import { NextResponse } from "next/server";

import { getBrivenAiAgentMe, isAiAgentConfigured } from "@/lib/briven-ai";
import {
  brivenProjectInfoWithM2m,
  getBrivenM2mToken,
  isM2mConfigured,
} from "@/lib/briven-m2m";

/**
 * Server-only health for machine credentials (M2M + AI agent).
 * Never returns secrets.
 */
export async function GET() {
  const projectId =
    process.env.BRIVEN_PROJECT_ID?.trim() ||
    process.env.NEXT_PUBLIC_BRIVEN_PROJECT_ID?.trim() ||
    null;

  const userAuthKeySet = Boolean(
    (
      process.env.NEXT_PUBLIC_BRIVEN_AUTH_KEY ||
      process.env.BRIVEN_AUTH_PUBLIC_KEY ||
      ""
    ).startsWith("pk_briven_auth_"),
  );

  // AI agent
  let ai:
    | { configured: false }
    | ({ configured: true } & Awaited<ReturnType<typeof getBrivenAiAgentMe>>) = {
    configured: false,
  };
  if (isAiAgentConfigured()) {
    const me = await getBrivenAiAgentMe();
    ai = { configured: true, ...me };
  }

  // M2M
  const m2m: {
    configured: boolean;
    ok?: boolean;
    tokenPreview?: string;
    projectInfo?: unknown;
    error?: string;
  } = { configured: isM2mConfigured() };

  if (m2m.configured) {
    try {
      const token = await getBrivenM2mToken();
      m2m.ok = true;
      m2m.tokenPreview = `${token.slice(0, 12)}…`;
      try {
        m2m.projectInfo = await brivenProjectInfoWithM2m();
      } catch (e) {
        m2m.error =
          e instanceof Error
            ? `token ok; project info: ${e.message}`
            : "token ok; project info failed";
      }
    } catch (e) {
      m2m.ok = false;
      m2m.error = e instanceof Error ? e.message : "m2m failed";
      // Platform 404 usually means api.briven.tech route not live yet — not bad local keys.
      if (
        m2m.error.includes("404") &&
        m2m.error.toLowerCase().includes("not found")
      ) {
        m2m.error = `${m2m.error} — credentials look set (m2m_/m2ms_); Briven API may be down or this path not deployed. Keys stay in .env.local.`;
      }
    }
  }

  return NextResponse.json({
    projectId,
    userAuth: {
      configured: userAuthKeySet,
      note: "Browser login uses pk_briven_auth_… (OTP/magic/Konnos). Email delivery needs sender domain on Briven.",
    },
    aiAgent: ai,
    m2m: {
      ...m2m,
      note: m2m.configured
        ? m2m.ok
          ? "Machine client credentials present and token mint works."
          : "Machine client credentials present in .env.local — token call failed (see error)."
        : "Create machine client in Auth → Keys (M2M), then set BRIVEN_M2M_CLIENT_ID + BRIVEN_M2M_CLIENT_SECRET in .env.local",
    },
  });
}