@aitne/daemon 0.1.0

package/dist/api/routes/integrations-reconcile.js

@@ -0,0 +1,463 @@
+import { Hono } from "hono";
+import { isIntegrationKey, getSnapshotNormalizer, listSnapshotNormalizers, } from "@aitne/shared";
+import { reconcile } from "../../services/integrations/reconcile.js";
+import { readJsonBody } from "../json-body.js";
+import { createLogger } from "../../logging.js";
+import { applyDriftEffects, emptyDriftSideEffects, } from "../../core/drift-effects.js";
+const logger = createLogger("integrations-reconcile-api");
+/**
+ * `POST /api/integrations/:key/reconcile` (INTEGRATION-DRIFT-DETECTION-PLAN.md
+ * §6).
+ *
+ * The handler validates the request,
+ * normalises payloads server-side (so LLM-driven callers can omit
+ * `contentHash` and the daemon-side hash always wins), runs the pure
+ * reconcile primitive, applies drift side effects inside the same SQLite
+ * transaction, writes one `agent_actions` audit row per call, and returns
+ * the diff.
+ *
+ * Risk tier: **Autonomous** (registered at `risk-classifier.ts:419`). The
+ * plan's §6.0 walk-through ("Autonomous tenable: a fabricating agent can
+ * pollute diffs but cannot launder a write as agent-attributed") is the
+ * rationale; the LLM-driven path is gated by the window-key allowlist
+ * below + per-call audit row. The endpoint mutates `integration_snapshots`
+ * and writes an audit row, and Phase 2's drift-effects also insert
+ * `agent_schedule` rows + emit on the EventBus inside the same transaction.
+ *
+ * Defense layers, in order:
+ *   1. Daemon-internal callers (CalendarPoller, DelegatedSyncWorker,
+ *      ImminentEventScheduler) call `reconcile()` directly. They bypass
+ *      this route entirely; their inputs come from already-trusted poll
+ *      paths.
+ *   2. LLM agents POST to this endpoint with a window-key from the
+ *      `RECONCILE_WINDOW_KEY_ALLOWLIST` below. Any other key returns 400.
+ *   3. Per-call audit row (`action_type='reconcile'`) lets operators spot
+ *      fabrication via `/api/observations/stats` `bySource`.
+ */
+export function createIntegrationReconcileRoutes(deps) {
+    const app = new Hono();
+    const { db } = deps;
+    app.post("/integrations/:key/reconcile", async (c) => {
+        const key = c.req.param("key");
+        if (!isIntegrationKey(key)) {
+            return c.json({ error: "unknown_integration", key }, 404);
+        }
+        const normalizer = getSnapshotNormalizer(key);
+        /* c8 ignore start — every IntegrationKey ships a normalizer after
+         *   Phase 5; the branch survives so a future integration whose
+         *   connector wiring lands before its normalizer fails fast with a
+         *   precise contract instead of a 500 deeper. */
+        if (!normalizer) {
+            return c.json({
+                error: "unsupported_integration",
+                message: `reconcile is not yet implemented for '${key}'`,
+                key,
+                supportedIntegrations: listSnapshotNormalizers(),
+            }, 400);
+        }
+        /* c8 ignore stop */
+        const parsedBody = await readJsonBody(c);
+        if (!parsedBody.ok)
+            return parsedBody.response;
+        // Phase 7 (k): `?dry-run=1` (or any truthy value) computes the diff
+        // against the prior snapshot but writes nothing — no UPSERT, no DELETE,
+        // no observation, no `today_refresh` schedule, no roadmap-refresh
+        // trigger. Operators use this to inspect what the next non-dry-run
+        // call would emit. The window-key allowlist (§6.0 defense layer 2) and
+        // per-call audit row still apply; the audit detail records `mode`
+        // so `audit --type=reconcile` retros separate inspections from real
+        // mutations.
+        const dryRunFlag = c.req.query("dry-run") ?? c.req.query("dryRun");
+        const isDryRun = isTruthyQueryFlag(dryRunFlag);
+        const startedAtIsoForValidation = new Date().toISOString();
+        const validation = validateReconcileBody(parsedBody.body, key);
+        if (!validation.ok) {
+            // §6.0 defense layer 3: every POST attempt leaves a trace, including
+            // malformed ones — operators rely on `bySource` in
+            // /api/observations/stats to spot fabrication, and a 400 with no
+            // record would let a misbehaving agent silently probe the route's
+            // validation surface.
+            writeReconcileAuditRow(deps, {
+                integration: key,
+                windowKey: typeof parsedBody.body?.windowKey
+                    === "string"
+                    ? parsedBody.body.windowKey
+                    : "<invalid>",
+                startedAtIso: startedAtIsoForValidation,
+                result: "failed",
+                items: 0,
+                callerHashMismatches: 0,
+                error: `validation_error:${validation.field}:${validation.error}`,
+                diff: null,
+                mode: isDryRun ? "dry-run" : "apply",
+            });
+            return c.json({
+                error: "validation_error",
+                message: validation.error,
+                field: validation.field,
+            }, 400);
+        }
+        const { req, callerHashMismatches } = validation;
+        const startedAtIso = new Date().toISOString();
+        let result;
+        let sideEffects = emptyDriftSideEffects();
+        let auditError = null;
+        try {
+            result = reconcile(db, { ...req, mode: isDryRun ? "dry-run" : "apply" }, {
+                normalizer,
+                // Drift effects must NOT run in dry-run; reconcile already
+                // honours `mode='dry-run'` by skipping `onDiffInTransaction`,
+                // but we also nullify the closure here as a belt-and-braces
+                // measure so a future refactor of reconcile cannot accidentally
+                // fire side effects on an inspection call.
+                onDiffInTransaction: isDryRun
+                    ? undefined
+                    : (diff) => {
+                        sideEffects = applyDriftEffects(req, diff, {
+                            db,
+                            calendarId: "primary",
+                            timezone: deps.config.timezone,
+                            todayWriteLock: deps.morningRoutineLock,
+                            triggerRoadmapRefresh: deps.triggerRoadmapRefresh,
+                        });
+                    },
+            });
+        }
+        catch (err) {
+            const message = err instanceof Error ? err.message : String(err);
+            auditError = message;
+            writeReconcileAuditRow(deps, {
+                integration: key,
+                windowKey: req.windowKey,
+                startedAtIso,
+                result: "failed",
+                items: req.items.length,
+                callerHashMismatches,
+                error: message,
+                diff: null,
+                mode: isDryRun ? "dry-run" : "apply",
+            });
+            logger.warn({ err, integration: key, windowKey: req.windowKey, dryRun: isDryRun }, "reconcile failed");
+            return c.json({ error: "reconcile_failed", message }, 500);
+        }
+        writeReconcileAuditRow(deps, {
+            integration: key,
+            windowKey: req.windowKey,
+            startedAtIso,
+            result: "success",
+            items: req.items.length,
+            callerHashMismatches,
+            error: auditError,
+            diff: result,
+            mode: isDryRun ? "dry-run" : "apply",
+        });
+        return c.json({
+            diff: {
+                created: result.created,
+                modified: result.modified,
+                deleted: result.deleted,
+                unchanged: result.unchanged,
+                prunedOutOfWindow: result.prunedOutOfWindow,
+                isInitialSnapshot: result.isInitialSnapshot,
+            },
+            sideEffects,
+            meta: {
+                callerHashMismatches,
+                mode: isDryRun ? "dry-run" : "apply",
+            },
+        });
+    });
+    return app;
+}
+/**
+ * Window keys an LLM-driven caller is allowed to author. Daemon-internal
+ * callers bypass the route and write any window key directly. Plan §6.0
+ * defense layer 2.
+ *
+ * Calendar-only by design (post-Phase-5 review): the LLM hourly_check
+ * Step 0b fetches the same `[now-15min, now+60min)` and `[now, now+24h)`
+ * windows the daemon's `delegated-sync-worker` uses for `primary:imminent`
+ * and `primary:24h`, so an LLM POST and a worker POST land in the same
+ * partition without disagreeing on bounds. Gmail (`inbox:7d`) and Notion
+ * (`recently_updated`) are deliberately NOT on this list: a narrow
+ * `newer_than:1d` (gmail) or `created_date_range:yesterday` (notion) LLM
+ * fetch posted into the worker's 7-day partition would classify every
+ * prior 1-7d-old item as `deleted` (the per-integration `inWindow`
+ * predicate evaluates the prior payload's date against the LLM's
+ * windowMin/Max, not the partition's nominal width — see
+ * `reconcile.ts:319-345`). The fix is to keep gmail/notion authoring
+ * inside the daemon worker only; the LLM consumes drift signals via
+ * `GET /api/observations`. The corresponding Step 0a / 0c blocks of
+ * `routine.hourly_check.delegated.<backend>.md` were rewritten to
+ * forbid the POST and document the rationale; this allowlist is the
+ * defense-in-depth backstop that catches a future overlay rewrite that
+ * silently re-introduces the LLM call.
+ *
+ * `primary:14d` is reserved for the direct-mode CalendarPoller (Phase 2)
+ * which calls reconcile in-process; it is intentionally absent here.
+ */
+const RECONCILE_WINDOW_KEY_ALLOWLIST = new Set([
+    "primary:24h",
+    "primary:imminent",
+]);
+/**
+ * Actor hints LLM-driven HTTP callers may attach to a reconcile item. The
+ * design (§4.2 + §6) names `integration_writes` as the *authoritative*
+ * source of `actor='agent'` attribution; `actorHint` is only a fallback for
+ * daemon-internal callers that bypass this route. An HTTP body claiming
+ * `actorHint='agent'` would let a confused-or-malicious agent suppress
+ * legitimate user-edit observations by laundering them through its own
+ * write. `system` is similarly daemon-internal-only. Daemon-internal
+ * callers (CalendarPoller, DelegatedSyncWorker, etc.) call `reconcile()`
+ * directly and bypass this validator entirely, so the constraint here is
+ * route-only.
+ */
+const HTTP_ACTOR_HINTS = new Set([
+    "user",
+    "unknown",
+]);
+/**
+ * Phase 7 (k): a query flag is "truthy" when present without a value
+ * (`?dry-run`), set to `1` / `true` / `yes` / `on` (any case), or any
+ * non-empty string that is not an explicit `0` / `false` / `no` / `off`.
+ * Mirrors the convention `?reset=1` style across the existing API
+ * surface (`/api/setup/...`, `/api/maintenance/...`).
+ */
+function isTruthyQueryFlag(value) {
+    if (value === undefined)
+        return false;
+    if (value === "")
+        return true;
+    const v = value.toLowerCase();
+    return v === "1" || v === "true" || v === "yes" || v === "on";
+}
+function isIsoLikeString(s) {
+    // Accept any non-empty string; the storage column is plain TEXT and
+    // SQLite's lexicographic comparison is what reconcile relies on. Strict
+    // ISO-8601 grammar is not the route's responsibility — it's the
+    // upstream API's. Empty strings would silently break the inWindow
+    // predicate, so we reject those.
+    return typeof s === "string" && s.length > 0;
+}
+/**
+ * Stricter check for the window-bound fields. The §5.1 sliding-window
+ * predicate parses windowMin/windowMax with `Date.parse` and silently
+ * treats NaN as "out of window", which would classify every prior item
+ * missing from a new fetch as `prunedOutOfWindow` and drop every real
+ * `deleted` observation on the floor. A typo like `windowMin: "yesterday"`
+ * should fail loudly at the route boundary, not silently break diff
+ * semantics three function calls deeper.
+ */
+function isParseableInstant(s) {
+    return typeof s === "string" && s.length > 0 && Number.isFinite(Date.parse(s));
+}
+function validateReconcileBody(body, key) {
+    if (body === null || typeof body !== "object" || Array.isArray(body)) {
+        return { ok: false, error: "body must be a JSON object", field: "body" };
+    }
+    const b = body;
+    const windowKey = b.windowKey;
+    if (typeof windowKey !== "string" || windowKey.length === 0) {
+        return {
+            ok: false,
+            error: "windowKey must be a non-empty string",
+            field: "windowKey",
+        };
+    }
+    if (!RECONCILE_WINDOW_KEY_ALLOWLIST.has(windowKey)) {
+        return {
+            ok: false,
+            error: `windowKey '${windowKey}' is not on the LLM-callable allowlist (allowed: ${[...RECONCILE_WINDOW_KEY_ALLOWLIST].sort().join(", ")})`,
+            field: "windowKey",
+        };
+    }
+    if (!isParseableInstant(b.windowMin)) {
+        return {
+            ok: false,
+            error: "windowMin is required and must parse to a valid instant",
+            field: "windowMin",
+        };
+    }
+    if (!isParseableInstant(b.windowMax)) {
+        return {
+            ok: false,
+            error: "windowMax is required and must parse to a valid instant",
+            field: "windowMax",
+        };
+    }
+    if (b.windowMin >= b.windowMax) {
+        return {
+            ok: false,
+            error: "windowMin must be strictly before windowMax",
+            field: "windowMin",
+        };
+    }
+    if (!isIsoLikeString(b.fetchedAt)) {
+        return { ok: false, error: "fetchedAt is required", field: "fetchedAt" };
+    }
+    // fetchedAt is also compared against `integration_writes.expires_at` to
+    // resolve the agent-write TTL — a malformed value would let an expired
+    // mark linger past its window, so we hold it to the same parseability
+    // bar as the window bounds.
+    if (!Number.isFinite(Date.parse(b.fetchedAt))) {
+        return {
+            ok: false,
+            error: "fetchedAt must parse to a valid instant",
+            field: "fetchedAt",
+        };
+    }
+    const itemsRaw = b.items;
+    if (!Array.isArray(itemsRaw)) {
+        return { ok: false, error: "items must be an array", field: "items" };
+    }
+    const isInitialSnapshot = b.isInitialSnapshot === undefined
+        ? undefined
+        : Boolean(b.isInitialSnapshot);
+    // Re-normalise every item server-side (§5.2). The shared normalizer
+    // accepts the raw payload shape and produces the canonical form +
+    // hash, so an LLM caller can POST upstream JSON verbatim and the
+    // server still computes a deterministic hash. We never trust the
+    // caller's hash value — it is recorded only so the audit row can
+    // surface drift.
+    const normalizer = getSnapshotNormalizer(key);
+    // The route returned 400 above when normalizer is undefined, so this
+    // narrowing is safe.
+    if (!normalizer) {
+        /* c8 ignore next */
+        return {
+            ok: false,
+            error: `reconcile is not implemented for '${key}'`,
+            field: "key",
+        };
+    }
+    const items = [];
+    let callerHashMismatches = 0;
+    for (let i = 0; i < itemsRaw.length; i += 1) {
+        const raw = itemsRaw[i];
+        if (raw === null || typeof raw !== "object" || Array.isArray(raw)) {
+            return {
+                ok: false,
+                error: `items[${i}] must be a JSON object`,
+                field: `items[${i}]`,
+            };
+        }
+        const r = raw;
+        // The caller may pass either a fully-canonical `{itemId, payload, ...}`
+        // shape (daemon-internal) or a raw upstream object (LLM-driven). We
+        // re-derive itemId / payload / hash from the raw object via the
+        // normalizer when `payload` is present; if the caller supplies only
+        // an itemId+payload pre-shape, normalizer.itemId(payload) still works
+        // because the canonical shape is a subset of the raw shape's fields.
+        const payloadRaw = r.payload ?? r;
+        let itemId;
+        let payload;
+        try {
+            itemId = normalizer.itemId(payloadRaw);
+            payload = normalizer.payload(payloadRaw);
+        }
+        catch (err) {
+            const message = err instanceof Error ? err.message : String(err);
+            return {
+                ok: false,
+                error: `items[${i}] failed normalization: ${message}`,
+                field: `items[${i}]`,
+            };
+        }
+        const serverHash = normalizer.hash(payload);
+        const callerHash = r.contentHash;
+        if (typeof callerHash === "string" && callerHash.length > 0
+            && callerHash !== serverHash) {
+            callerHashMismatches += 1;
+        }
+        let actorHint;
+        if (r.actorHint !== undefined) {
+            if (typeof r.actorHint !== "string"
+                || !HTTP_ACTOR_HINTS.has(r.actorHint)) {
+                return {
+                    ok: false,
+                    error: `items[${i}].actorHint must be one of ${[...HTTP_ACTOR_HINTS].sort().join(", ")} (agent attribution flows through integration_writes; system is daemon-internal only)`,
+                    field: `items[${i}].actorHint`,
+                };
+            }
+            actorHint = r.actorHint;
+        }
+        // Caller-supplied itemId wins when explicitly set so callers that key
+        // by something other than the normalizer's default (rare; mostly tests
+        // and forward-compat) can override. Otherwise the normalizer's id is
+        // authoritative — including for recurring-event instance keys.
+        const explicitItemId = typeof r.itemId === "string" && r.itemId.length > 0
+            ? r.itemId
+            : itemId;
+        items.push({
+            itemId: explicitItemId,
+            contentHash: serverHash,
+            payload,
+            itemStart: normalizer.itemStart(payloadRaw),
+            actorHint,
+        });
+    }
+    return {
+        ok: true,
+        req: {
+            integration: key,
+            windowKey,
+            windowMin: b.windowMin,
+            windowMax: b.windowMax,
+            fetchedAt: b.fetchedAt,
+            items,
+            isInitialSnapshot,
+        },
+        callerHashMismatches,
+    };
+}
+/**
+ * Phase 1 chokepoint audit row. Always written, regardless of success or
+ * failure (§6.0 defense layer 3). Operators can grep
+ * `agent_actions.action_type = 'reconcile'` for fabrication / hash drift /
+ * unexpected delete bursts.
+ *
+ * The `detail` JSON intentionally omits `payload` bodies — those live in
+ * `integration_snapshots` and would bloat the action log otherwise. Counts
+ * are sufficient for retrospective.
+ */
+function writeReconcileAuditRow(deps, args) {
+    try {
+        const detail = {
+            integration: args.integration,
+            windowKey: args.windowKey,
+            itemsSeen: args.items,
+            callerHashMismatches: args.callerHashMismatches,
+            mode: args.mode,
+            ...(args.diff
+                ? {
+                    created: args.diff.created.length,
+                    modified: args.diff.modified.length,
+                    deleted: args.diff.deleted.length,
+                    unchanged: args.diff.unchanged,
+                    prunedOutOfWindow: args.diff.prunedOutOfWindow,
+                    isInitialSnapshot: args.diff.isInitialSnapshot,
+                }
+                : {}),
+        };
+        // `trigger` is left NULL — this Phase-1 route accepts calls that have
+        // no parent process key (LLM-initiated drift probe). Phase 3's
+        // DelegatedSyncWorker will pass `x-process-key` in a forthcoming
+        // signed header and propagate it here. Operators query reconcile
+        // activity via `action_type='reconcile'` + the integration field
+        // inside `detail`, not via `trigger`.
+        deps.db
+            .prepare(`INSERT INTO agent_actions (
+           event_id, action_type, trigger, result, detail,
+           started_at, completed_at, error
+         ) VALUES (
+           NULL, 'reconcile', NULL, ?, ?,
+           datetime(?), datetime('now'), ?
+         )`)
+            .run(args.result, JSON.stringify(detail), args.startedAtIso, args.error);
+    }
+    catch (err) {
+        /* c8 ignore next 5 */
+        logger.error({ err, integration: args.integration, windowKey: args.windowKey }, "failed to record reconcile audit row");
+    }
+}
+//# sourceMappingURL=integrations-reconcile.js.map

package/dist/api/routes/integrations-reconcile.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"integrations-reconcile.js","sourceRoot":"","sources":["../../../src/api/routes/integrations-reconcile.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EACL,gBAAgB,EAChB,qBAAqB,EACrB,uBAAuB,GAGxB,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,SAAS,EAAsB,MAAM,0CAA0C,CAAC;AACzF,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAC/C,OAAO,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAEhD,OAAO,EACL,iBAAiB,EACjB,qBAAqB,GAEtB,MAAM,6BAA6B,CAAC;AAErC,MAAM,MAAM,GAAG,YAAY,CAAC,4BAA4B,CAAC,CAAC;AAE1D;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,MAAM,UAAU,gCAAgC,CAC9C,IAAqB;IAErB,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;IACvB,MAAM,EAAE,EAAE,EAAE,GAAG,IAAI,CAAC;IAEpB,GAAG,CAAC,IAAI,CAAC,8BAA8B,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACnD,MAAM,GAAG,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC/B,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,EAAE,CAAC;YAC3B,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,qBAAqB,EAAE,GAAG,EAAE,EAAE,GAAG,CAAC,CAAC;QAC5D,CAAC;QAED,MAAM,UAAU,GAAG,qBAAqB,CAAC,GAAG,CAAC,CAAC;QAC9C;;;yDAGiD;QACjD,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,OAAO,CAAC,CAAC,IAAI,CACX;gBACE,KAAK,EAAE,yBAAyB;gBAChC,OAAO,EACL,yCAAyC,GAAG,GAAG;gBACjD,GAAG;gBACH,qBAAqB,EAAE,uBAAuB,EAAE;aACjD,EACD,GAAG,CACJ,CAAC;QACJ,CAAC;QACD,oBAAoB;QAEpB,MAAM,UAAU,GAAG,MAAM,YAAY,CAAC,CAAC,CAAC,CAAC;QACzC,IAAI,CAAC,UAAU,CAAC,EAAE;YAAE,OAAO,UAAU,CAAC,QAAQ,CAAC;QAE/C,oEAAoE;QACpE,wEAAwE;QACxE,kEAAkE;QAClE,mEAAmE;QACnE,uEAAuE;QACvE,kEAAkE;QAClE,oEAAoE;QACpE,aAAa;QACb,MAAM,UAAU,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QACnE,MAAM,QAAQ,GAAG,iBAAiB,CAAC,UAAU,CAAC,CAAC;QAE/C,MAAM,yBAAyB,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QAC3D,MAAM,UAAU,GAAG,qBAAqB,CAAC,UAAU,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QAC/D,IAAI,CAAC,UAAU,CAAC,EAAE,EAAE,CAAC;YACnB,qEAAqE;YACrE,mDAAmD;YACnD,iEAAiE;YACjE,kEAAkE;YAClE,sBAAsB;YACtB,sBAAsB,CAAC,IAAI,EAAE;gBAC3B,WAAW,EAAE,GAAG;gBAChB,SAAS,EACP,OAAQ,UAAU,CAAC,IAAgC,EAAE,SAAS;wBACxD,QAAQ;oBACZ,CAAC,CAAE,UAAU,CAAC,IAA8B,CAAC,SAAS;oBACtD,CAAC,CAAC,WAAW;gBACjB,YAAY,EAAE,yBAAyB;gBACvC,MAAM,EAAE,QAAQ;gBAChB,KAAK,EAAE,CAAC;gBACR,oBAAoB,EAAE,CAAC;gBACvB,KAAK,EAAE,oBAAoB,UAAU,CAAC,KAAK,IAAI,UAAU,CAAC,KAAK,EAAE;gBACjE,IAAI,EAAE,IAAI;gBACV,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO;aACrC,CAAC,CAAC;YACH,OAAO,CAAC,CAAC,IAAI,CACX;gBACE,KAAK,EAAE,kBAAkB;gBACzB,OAAO,EAAE,UAAU,CAAC,KAAK;gBACzB,KAAK,EAAE,UAAU,CAAC,KAAK;aACxB,EACD,GAAG,CACJ,CAAC;QACJ,CAAC;QAED,MAAM,EAAE,GAAG,EAAE,oBAAoB,EAAE,GAAG,UAAU,CAAC;QAEjD,MAAM,YAAY,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QAC9C,IAAI,MAAoC,CAAC;QACzC,IAAI,WAAW,GAAqB,qBAAqB,EAAE,CAAC;QAC5D,IAAI,UAAU,GAAkB,IAAI,CAAC;QACrC,IAAI,CAAC;YACH,MAAM,GAAG,SAAS,CAChB,EAAE,EACF,EAAE,GAAG,GAAG,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,EAAE,EAChD;gBACE,UAAU;gBACV,2DAA2D;gBAC3D,8DAA8D;gBAC9D,4DAA4D;gBAC5D,gEAAgE;gBAChE,2CAA2C;gBAC3C,mBAAmB,EAAE,QAAQ;oBAC3B,CAAC,CAAC,SAAS;oBACX,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE;wBACT,WAAW,GAAG,iBAAiB,CAAC,GAAG,EAAE,IAAI,EAAE;4BACzC,EAAE;4BACF,UAAU,EAAE,SAAS;4BACrB,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ;4BAC9B,cAAc,EAAE,IAAI,CAAC,kBAAkB;4BACvC,qBAAqB,EAAE,IAAI,CAAC,qBAAqB;yBAClD,CAAC,CAAC;oBACL,CAAC;aACJ,CACF,CAAC;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACjE,UAAU,GAAG,OAAO,CAAC;YACrB,sBAAsB,CAAC,IAAI,EAAE;gBAC3B,WAAW,EAAE,GAAG;gBAChB,SAAS,EAAE,GAAG,CAAC,SAAS;gBACxB,YAAY;gBACZ,MAAM,EAAE,QAAQ;gBAChB,KAAK,EAAE,GAAG,CAAC,KAAK,CAAC,MAAM;gBACvB,oBAAoB;gBACpB,KAAK,EAAE,OAAO;gBACd,IAAI,EAAE,IAAI;gBACV,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO;aACrC,CAAC,CAAC;YACH,MAAM,CAAC,IAAI,CACT,EAAE,GAAG,EAAE,WAAW,EAAE,GAAG,EAAE,SAAS,EAAE,GAAG,CAAC,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,EACrE,kBAAkB,CACnB,CAAC;YACF,OAAO,CAAC,CAAC,IAAI,CACX,EAAE,KAAK,EAAE,kBAAkB,EAAE,OAAO,EAAE,EACtC,GAAG,CACJ,CAAC;QACJ,CAAC;QAED,sBAAsB,CAAC,IAAI,EAAE;YAC3B,WAAW,EAAE,GAAG;YAChB,SAAS,EAAE,GAAG,CAAC,SAAS;YACxB,YAAY;YACZ,MAAM,EAAE,SAAS;YACjB,KAAK,EAAE,GAAG,CAAC,KAAK,CAAC,MAAM;YACvB,oBAAoB;YACpB,KAAK,EAAE,UAAU;YACjB,IAAI,EAAE,MAAM;YACZ,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO;SACrC,CAAC,CAAC;QAEH,OAAO,CAAC,CAAC,IAAI,CAAC;YACZ,IAAI,EAAE;gBACJ,OAAO,EAAE,MAAM,CAAC,OAAO;gBACvB,QAAQ,EAAE,MAAM,CAAC,QAAQ;gBACzB,OAAO,EAAE,MAAM,CAAC,OAAO;gBACvB,SAAS,EAAE,MAAM,CAAC,SAAS;gBAC3B,iBAAiB,EAAE,MAAM,CAAC,iBAAiB;gBAC3C,iBAAiB,EAAE,MAAM,CAAC,iBAAiB;aAC5C;YACD,WAAW;YACX,IAAI,EAAE;gBACJ,oBAAoB;gBACpB,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO;aACrC;SACF,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,MAAM,8BAA8B,GAAwB,IAAI,GAAG,CAAC;IAClE,aAAa;IACb,kBAAkB;CACnB,CAAC,CAAC;AAEH;;;;;;;;;;;GAWG;AACH,MAAM,gBAAgB,GAAmC,IAAI,GAAG,CAAC;IAC/D,MAAM;IACN,SAAS;CACV,CAAC,CAAC;AA4BH;;;;;;GAMG;AACH,SAAS,iBAAiB,CAAC,KAAyB;IAClD,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IACtC,IAAI,KAAK,KAAK,EAAE;QAAE,OAAO,IAAI,CAAC;IAC9B,MAAM,CAAC,GAAG,KAAK,CAAC,WAAW,EAAE,CAAC;IAC9B,OAAO,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,MAAM,IAAI,CAAC,KAAK,KAAK,IAAI,CAAC,KAAK,IAAI,CAAC;AAChE,CAAC;AAED,SAAS,eAAe,CAAC,CAAU;IACjC,oEAAoE;IACpE,wEAAwE;IACxE,gEAAgE;IAChE,kEAAkE;IAClE,iCAAiC;IACjC,OAAO,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;AAC/C,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,kBAAkB,CAAC,CAAU;IACpC,OAAO,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,IAAI,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;AACjF,CAAC;AAED,SAAS,qBAAqB,CAC5B,IAAa,EACb,GAAmB;IAEnB,IAAI,IAAI,KAAK,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QACrE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,4BAA4B,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;IAC3E,CAAC;IACD,MAAM,CAAC,GAAG,IAA+B,CAAC;IAE1C,MAAM,SAAS,GAAG,CAAC,CAAC,SAAS,CAAC;IAC9B,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5D,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,sCAAsC;YAC7C,KAAK,EAAE,WAAW;SACnB,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,8BAA8B,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;QACnD,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EACH,cAAc,SAAS,oDAAoD,CAAC,GAAG,8BAA8B,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;YACrI,KAAK,EAAE,WAAW;SACnB,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,kBAAkB,CAAC,CAAC,CAAC,SAAS,CAAC,EAAE,CAAC;QACrC,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,yDAAyD;YAChE,KAAK,EAAE,WAAW;SACnB,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,kBAAkB,CAAC,CAAC,CAAC,SAAS,CAAC,EAAE,CAAC;QACrC,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,yDAAyD;YAChE,KAAK,EAAE,WAAW;SACnB,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,CAAC,SAAS,IAAI,CAAC,CAAC,SAAS,EAAE,CAAC;QAC/B,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,6CAA6C;YACpD,KAAK,EAAE,WAAW;SACnB,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC,SAAS,CAAC,EAAE,CAAC;QAClC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,uBAAuB,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC;IAC3E,CAAC;IACD,wEAAwE;IACxE,uEAAuE;IACvE,sEAAsE;IACtE,4BAA4B;IAC5B,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC;QAC9C,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,yCAAyC;YAChD,KAAK,EAAE,WAAW;SACnB,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAG,CAAC,CAAC,KAAK,CAAC;IACzB,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC7B,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,wBAAwB,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;IACxE,CAAC;IAED,MAAM,iBAAiB,GACnB,CAAC,CAAC,iBAAiB,KAAK,SAAS;QACjC,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC;IAEnC,oEAAoE;IACpE,kEAAkE;IAClE,iEAAiE;IACjE,iEAAiE;IACjE,iEAAiE;IACjE,iBAAiB;IACjB,MAAM,UAAU,GAAG,qBAAqB,CAAC,GAAG,CAAC,CAAC;IAC9C,qEAAqE;IACrE,qBAAqB;IACrB,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,oBAAoB;QACpB,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,qCAAqC,GAAG,GAAG;YAClD,KAAK,EAAE,KAAK;SACb,CAAC;IACJ,CAAC;IAED,MAAM,KAAK,GAAoB,EAAE,CAAC;IAClC,IAAI,oBAAoB,GAAG,CAAC,CAAC;IAC7B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,QAAQ,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QAC5C,MAAM,GAAG,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC;QACxB,IAAI,GAAG,KAAK,IAAI,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;YAClE,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,KAAK,EAAE,SAAS,CAAC,yBAAyB;gBAC1C,KAAK,EAAE,SAAS,CAAC,GAAG;aACrB,CAAC;QACJ,CAAC;QACD,MAAM,CAAC,GAAG,GAA8B,CAAC;QAEzC,wEAAwE;QACxE,oEAAoE;QACpE,gEAAgE;QAChE,oEAAoE;QACpE,sEAAsE;QACtE,qEAAqE;QACrE,MAAM,UAAU,GAAG,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC;QAClC,IAAI,MAAc,CAAC;QACnB,IAAI,OAAgB,CAAC;QACrB,IAAI,CAAC;YACH,MAAM,GAAG,UAAU,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;YACvC,OAAO,GAAG,UAAU,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;QAC3C,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACjE,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,KAAK,EAAE,SAAS,CAAC,2BAA2B,OAAO,EAAE;gBACrD,KAAK,EAAE,SAAS,CAAC,GAAG;aACrB,CAAC;QACJ,CAAC;QAED,MAAM,UAAU,GAAG,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC5C,MAAM,UAAU,GAAG,CAAC,CAAC,WAAW,CAAC;QACjC,IAAI,OAAO,UAAU,KAAK,QAAQ,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC;eACtD,UAAU,KAAK,UAAU,EAAE,CAAC;YAC/B,oBAAoB,IAAI,CAAC,CAAC;QAC5B,CAAC;QAED,IAAI,SAAwC,CAAC;QAC7C,IAAI,CAAC,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;YAC9B,IAAI,OAAO,CAAC,CAAC,SAAS,KAAK,QAAQ;mBAC9B,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAAC,SAA8B,CAAC,EAAE,CAAC;gBAC7D,OAAO;oBACL,EAAE,EAAE,KAAK;oBACT,KAAK,EAAE,SAAS,CAAC,8BAA8B,CAAC,GAAG,gBAAgB,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,uFAAuF;oBAC7K,KAAK,EAAE,SAAS,CAAC,aAAa;iBAC/B,CAAC;YACJ,CAAC;YACD,SAAS,GAAG,CAAC,CAAC,SAA8B,CAAC;QAC/C,CAAC;QAED,sEAAsE;QACtE,uEAAuE;QACvE,qEAAqE;QACrE,+DAA+D;QAC/D,MAAM,cAAc,GAAG,OAAO,CAAC,CAAC,MAAM,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC;YACxE,CAAC,CAAC,CAAC,CAAC,MAAM;YACV,CAAC,CAAC,MAAM,CAAC;QAEX,KAAK,CAAC,IAAI,CAAC;YACT,MAAM,EAAE,cAAc;YACtB,WAAW,EAAE,UAAU;YACvB,OAAO;YACP,SAAS,EAAE,UAAU,CAAC,SAAS,CAAC,UAAU,CAAC;YAC3C,SAAS;SACV,CAAC,CAAC;IACL,CAAC;IAED,OAAO;QACL,EAAE,EAAE,IAAI;QACR,GAAG,EAAE;YACH,WAAW,EAAE,GAAG;YAChB,SAAS;YACT,SAAS,EAAE,CAAC,CAAC,SAAS;YACtB,SAAS,EAAE,CAAC,CAAC,SAAS;YACtB,SAAS,EAAE,CAAC,CAAC,SAAS;YACtB,KAAK;YACL,iBAAiB;SAClB;QACD,oBAAoB;KACrB,CAAC;AACJ,CAAC;AAED;;;;;;;;;GASG;AACH,SAAS,sBAAsB,CAC7B,IAAqB,EACrB,IAUC;IAED,IAAI,CAAC;QACH,MAAM,MAAM,GAAG;YACb,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,SAAS,EAAE,IAAI,CAAC,KAAK;YACrB,oBAAoB,EAAE,IAAI,CAAC,oBAAoB;YAC/C,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,GAAG,CAAC,IAAI,CAAC,IAAI;gBACX,CAAC,CAAC;oBACA,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM;oBACjC,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM;oBACnC,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM;oBACjC,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,SAAS;oBAC9B,iBAAiB,EAAE,IAAI,CAAC,IAAI,CAAC,iBAAiB;oBAC9C,iBAAiB,EAAE,IAAI,CAAC,IAAI,CAAC,iBAAiB;iBAC/C;gBACD,CAAC,CAAC,EAAE,CAAC;SACR,CAAC;QACF,sEAAsE;QACtE,+DAA+D;QAC/D,iEAAiE;QACjE,iEAAiE;QACjE,iEAAiE;QACjE,sCAAsC;QACtC,IAAI,CAAC,EAAE;aACJ,OAAO,CACN;;;;;;WAMG,CACJ;aACA,GAAG,CACF,IAAI,CAAC,MAAM,EACX,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EACtB,IAAI,CAAC,YAAY,EACjB,IAAI,CAAC,KAAK,CACX,CAAC;IACN,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,sBAAsB;QACtB,MAAM,CAAC,KAAK,CACV,EAAE,GAAG,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,EACjE,sCAAsC,CACvC,CAAC;IACJ,CAAC;AACH,CAAC"}

package/dist/api/routes/integrations.d.ts

@@ -0,0 +1,19 @@
+import { Hono } from "hono";
+import type { ApiDependencies } from "../server.js";
+/**
+ * Integration Delegation Framework — `/api/integrations` routes (Phase 1).
+ *
+ * Scope per `GOOGLE_AUTH_DELEGATION_DESIGN.md` Phase 1:
+ *   - `GET /api/integrations` — list every registered integration with its
+ *     descriptor metadata and current state.
+ *   - `PATCH /api/integrations/:key` — change a single integration's mode.
+ *     Runs a minimal lifecycle: validate → DB update → re-render
+ *     `integrations.md` → audit row. Observer gating, route-410 middleware,
+ *     skill variant selection, and the connector probe all land in later
+ *     phases.
+ *
+ * Risk tier: Approve (dashboard-only mutation, registered in
+ * `risk-classifier.ts`).
+ */
+export declare function createIntegrationRoutes(deps: ApiDependencies): Hono;
+//# sourceMappingURL=integrations.d.ts.map

package/dist/api/routes/integrations.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"integrations.d.ts","sourceRoot":"","sources":["../../../src/api/routes/integrations.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAgB,MAAM,MAAM,CAAC;AAiD1C,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAIpD;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,eAAe,GAAG,IAAI,CAszCnE"}