feat(embed): add the Go router (net/http) by mattj-monad · Pull Request #15 · monad-inc/embed

mattj-monad · 2026-07-30T20:29:57Z

Layer 4 of the Monad Embed SDK staged rollout (PRO-403). Stacked on #14 (PRO-402) — targets feature/pro-402; review/merge the stack bottom-up.

What this adds

routers/go — the Go port of the /embed router: embed.Router(embed.Config{…}) on the standard library net/http, zero third-party dependencies (module github.com/monad-inc/embed/routers/go). Idiomatic Go; same contract.
Generalizes the CI conformance job into a ts + go matrix. The Go leg boots go run ./cmd/conformance and runs the same suite with ROUTER=go.

Verification (local)

go vet + go test pass
conformance: ROUTER=go 14/14, ROUTER=ts 14/14 (regression)

Reviewers judge idiomatic Go; conformance proves contract-parity with the TS router.

Stack

400 → 401 → 402 → 403 → 404 (Python) → 405 (docs/CI).

🤖 Generated with Claude Code

https://claude.ai/code/session_011ASKA2VrufrNLGGrcFjY7n

mattj-monad · 2026-07-30T22:51:21Z

Force-pushed review fixes (Go router):

Path injection: url.PathEscape on every id + org (client.go and the embed.go delete paths).
Upstream body leak: upstream detail is logged server-side; the browser gets a generic 502.
Construction guard: Router() now fails fast with a clear panic if GetCustomerOrgID is nil, instead of a per-request nil-deref that kills the connection.
go vet/go test pass; ROUTER=go conformance 17/17.

mattj-monad · 2026-07-30T23:47:09Z

Force-pushed: 404/409 handling for the Go router — added a typed upstreamError{status, detail} (client.go) and upstream() now maps 404 → not_found / 409 → conflict / else 502 via errors.As. ROUTER=go conformance 19/19.

Credgate · 2026-07-31T17:56:56Z

+
+// esc URL-encodes a single path segment so browser-supplied ids can't inject
+// query params or traverse the path (`/`, `?`, `#` are neutralised).
+var esc = url.PathEscape


🤔 is this really needed?

Credgate · 2026-07-31T17:59:04Z

+}
+
+func (c *client) listCatalog(ctx context.Context, kind string, allow []string) ([]CatalogType, error) {
+	data, err := c.do(ctx, "GET", "/v1/"+kind+"s", nil)


why add s to every kind? why not rely on them passing the correct kindS? Should we make an enum for this so they know what kinds are valid?

Credgate · 2026-07-31T17:59:23Z

+}
+
+func (c *client) listConnectors(ctx context.Context, org, kind string) ([]ConfiguredConnector, error) {
+	data, err := c.do(ctx, "GET", "/v1/"+esc(org)+"/"+kind+"s?limit=1000&offset=0", nil)


same here kind[s]

Credgate

List endpoints should support pagination with an ease of use Next() method or something so the caller can actually list all of the underlying resources. i believe list pipelines today returns a max of 10 by default since you're not passing any limit params. you can wrap all models in {rows, Pagination{total,limit,offset}}.

You have a couple methods around getting a pipelines status by a component but getting the component itself should already be returning that info in the component_of key.

Credgate · 2026-07-31T18:31:25Z

+}
+
+func (c *client) listPipelines(ctx context.Context, org string) ([]pipeSummary, error) {
+	data, err := c.do(ctx, "GET", "/v2/"+esc(org)+"/pipelines/", nil)


This is only ever going to return 10 pipelines without proper pagination. All of our pagination is handled with a simple struct. you could implement a pagination response with a next funct or something to make pagination through returned results simple.

Credgate · 2026-07-31T18:33:19Z

+}
+
+// statusByInput resolves the pipeline an input feeds, knowing only the input id.
+func (c *client) statusByInput(ctx context.Context, org, inputID string) (PipelineStatus, error) {


GET /v1/{org}/outputs/{id}
GET /v1/{org}/inputs/{id}
already returns a component_of value so you shouldn't need to do this at all to get the status of an input.

Credgate · 2026-07-31T18:34:07Z

+			"disabled": dis, "conditions": e.Conditions,
+		})
+	}
+	_, err = c.do(ctx, "PATCH", "/v2/"+esc(org)+"/pipelines/"+esc(pipelineID), map[string]any{


This endpoint should work like a true patch now so you can safely pass just enabled bool and the other field states should be preserved.

Credgate · 2026-07-31T18:37:45Z

+// buildDevNull creates a throwaway dev/null output, then wires the input to it.
+func (c *client) buildDevNull(ctx context.Context, org, inputID, name string) (BuiltPipeline, error) {
+	data, err := c.do(ctx, "POST", "/v2/"+esc(org)+"/outputs", map[string]any{
+		"output_type": "dev-null",


you can just pass type now :P

Credgate · 2026-07-31T18:40:58Z

+	var page map[string][]struct {
+		ID   string `json:"id"`
+		Type string `json:"type"`
+		Name string `json:"name"`
+	}
+	if err := json.Unmarshal(data, &page); err != nil {
+		return nil, err
+	}


I have a hard time believing this unmarhsall will actually work

Credgate · 2026-07-31T18:42:24Z

+	var arr []pipeSummary
+	if json.Unmarshal(data, &arr) == nil && len(arr) > 0 {
+		return arr, nil
+	}
+	var obj struct {
+		Pipelines []pipeSummary `json:"pipelines"`
+		Data      []pipeSummary `json:"data"`
+	}
+	if err := json.Unmarshal(data, &obj); err != nil {
+		return nil, err
+	}
+	if len(obj.Pipelines) > 0 {
+		return obj.Pipelines, nil
+	}
+	return obj.Data, nil


This response model doesn't look correct to me either and what is the point of data vs pipelines key they are essentially the same thing. maybe claude was guessing what the key was or something? hah

Credgate · 2026-07-31T19:58:36Z

+| `APIKey`                   | Long-lived Monad API key (server-side only).                                                                   |
+| `APIBase`                  | Monad API base. Optional — defaults to `https://app.monad.com/api` (production).                               |
+| `FrameOrigin`              | Iframe origin returned by `GET /embed/config`. Optional — defaults to production.                              |
+| `GetCustomerOrgID`         | Map the authenticated request → the tenant's Monad team id. Return `("", nil)` or an error to reject (→ 401).  |


Okay i see what i was missing - this is actually a security boundary. The guide may want to point to that fact. This should convert their bearer token -> monad organization id.

mattj-monad · 2026-07-31T20:31:03Z

Force-pushed: fixed a real listConnectors bug found running the demo against live Monad staging. Real Monad returns { outputs: [...], pagination: {…} }; the Go decode used map[string][]struct{…}, which forces every top-level key (including pagination, an object) to be an array → json: cannot unmarshal object into []struct. TS/Python only read the <kind>s key, so they were unaffected. Now decodes map[string]json.RawMessage and unmarshals just the <kind>s array. Paired with the mock hardening in #14, conformance now covers this class. ROUTER=go 19/19.

Adds the Go port of the /embed router — embed.Router(embed.Config{...}) on the standard library net/http, zero third-party dependencies (module github.com/monad-inc/embed/routers/go). Same contract, idiomatic Go. Generalizes the conformance CI job to a ts + go matrix; the Go leg boots `go run ./cmd/conformance` and runs ROUTER=go against the same suite, proving contract-parity with the TypeScript router. Local: go vet + go test pass; conformance green for ROUTER=go and ROUTER=ts. Layer 4 (PRO-403), stacked on the TS router + conformance (PRO-402). Co-Authored-By: Claude Opus 4.8 <[email protected]> Claude-Session: https://claude.ai/code/session_011ASKA2VrufrNLGGrcFjY7n

Parameterizes the Go conformance server (cmd/conformance) from env with the same knobs as the TS/Python servers, defaulting to the mock fixtures. Co-Authored-By: Claude Opus 4.8 <[email protected]> Claude-Session: https://claude.ai/code/session_011ASKA2VrufrNLGGrcFjY7n

…[PRO-455] Review of the Go port (#15) surfaced defects the TypeScript reference has too. Validated against the API source rather than the published spec, which is stale. - resolve a connector's pipeline via `GET /v1/{org}/{kind}s/{id}`'s `component_of` instead of scanning every pipeline. The scan sent no `limit`, so past the tenant's tenth pipeline it reported "not connected" for pipelines that exist. - `setEnabled` now PATCHes `{enabled}` alone. PATCH became a true partial update in api#2163; the read-modify-write it replaces silently dropped node `config_overrides` and edge `schema_detection_spec` on every toggle. - drain the connector list instead of one `limit=1000` request - send `type` on output create; `output_type` is deprecated (api#2156) - drop the speculative `data` / `config` response-shape fallbacks — Monad returns neither - map `kind` to its path segment explicitly rather than appending "s"

mattj-monad requested review from Credgate, alastaird-monad, andrewc-monad, brenth-monad, mon-aneesh and saikapuluru99 as code owners July 30, 2026 20:29

mattj-monad mentioned this pull request Jul 30, 2026

feat(embed): add the Python router (FastAPI) #16

Open

mattj-monad force-pushed the feature/pro-403 branch from 09e02ec to b06e491 Compare July 30, 2026 22:50

mattj-monad force-pushed the feature/pro-402 branch from 044e201 to 34ceccc Compare July 30, 2026 22:50

mattj-monad force-pushed the feature/pro-403 branch from b06e491 to b760aa8 Compare July 30, 2026 23:46

mattj-monad force-pushed the feature/pro-402 branch from 34ceccc to 1cb65e7 Compare July 30, 2026 23:46

mattj-monad force-pushed the feature/pro-403 branch from b760aa8 to e287e68 Compare July 31, 2026 00:25

Credgate reviewed Jul 31, 2026

View reviewed changes

Credgate requested changes Jul 31, 2026

View reviewed changes

Credgate reviewed Jul 31, 2026

View reviewed changes

mattj-monad force-pushed the feature/pro-402 branch from 1cb65e7 to 5f893f2 Compare July 31, 2026 20:30

mattj-monad force-pushed the feature/pro-403 branch from e287e68 to a0dd428 Compare July 31, 2026 20:30

mattj-monad mentioned this pull request Jul 31, 2026

feat(embed): add the TypeScript router + conformance suite #14

Open

mattj-monad force-pushed the feature/pro-402 branch from 5f893f2 to 55e229f Compare July 31, 2026 20:42

mattj-monad force-pushed the feature/pro-403 branch 2 times, most recently from 25d2e86 to 3315bdb Compare July 31, 2026 21:12

mattj-monad force-pushed the feature/pro-402 branch from 55e229f to 2f59032 Compare July 31, 2026 21:12

mattj-monad and others added 2 commits July 31, 2026 15:42

mattj-monad force-pushed the feature/pro-403 branch from 3315bdb to 0e66ed7 Compare July 31, 2026 22:58

This was referenced Aug 4, 2026

fix(embed): conformance mock + TypeScript router vs the real Monad API [PRO-455] #17

Open

fix(embed): Go router vs the real Monad API [PRO-456] #18

Open

fix(embed): Python router vs the real Monad API [PRO-457] #19

Open

Uh oh!

Conversation

mattj-monad commented Jul 30, 2026

What this adds

Verification (local)

Stack

Uh oh!

mattj-monad commented Jul 30, 2026

Uh oh!

mattj-monad commented Jul 30, 2026

Uh oh!

Credgate Jul 31, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Credgate left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

mattj-monad commented Jul 31, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Credgate Jul 31, 2026 •

edited

Loading

Credgate left a comment •

edited

Loading