@aitne/daemon 0.1.7 → 0.1.8

package/dist/api/routes/integrations/crud-patch.js

@@ -0,0 +1,600 @@
+import { INTEGRATION_DESCRIPTORS, filterDeniedToolsForBackend, integrationPatchSchema, isIntegrationKey, recommendedStarterDeniedTools, supportedNativeBackends, validateDeniedTools, } from "@aitne/shared";
+import { readIntegrations, updateIntegrationState, } from "../../../db/integrations-store.js";
+import { writeManagementMd } from "../../../core/management-md.js";
+import { missingDelegatedVariants, missingNativeVariants, } from "../../../core/skills-compiler.js";
+import { acquireIntegrationFlipLock, releaseIntegrationFlipLock, } from "../../../core/integration-lifecycle.js";
+import { readMainBackend } from "../../../core/integration-main-backend.js";
+import { deleteProbesForIntegration } from "../../../db/integration-probe-store.js";
+import { knownProxyModels, proxyModelIsKnown, } from "../../../core/backends/proxy-model-registry.js";
+import { readJsonBody } from "../../json-body.js";
+import { createLogger } from "../../../logging.js";
+import { composeIssue, respondWithAgentError } from "../../helpers/agent-errors.js";
+import { createSettingsStore } from "../../../settings/settings-store.js";
+const logger = createLogger("integrations-api");
+/**
+ * `PATCH /api/integrations/:key` handler body.
+ *
+ * Extracted from the original `routes/integrations.ts` createIntegrationRoutes
+ * factory so the surrounding `crud.ts` stays under the ~800 line soft
+ * ceiling. Behavior is byte-identical to the pre-split inline closure.
+ *
+ * Lifecycle (mirrors `docs/design/14-integration-delegation.md` §14.6):
+ *   validate → flip-lock acquire → mode-specific gates (native, delegated,
+ *   delegatedModel, deniedTools) → DB update → `integrations.md` re-render →
+ *   probe-cache eviction → running-session re-materialisation →
+ *   audit → flip-lock release.
+ */
+export async function handleIntegrationPatch(c, deps) {
+    const { db, config } = deps;
+    // `c.req.param("key")` is typed `string` inside an `app.patch("/:key", ...)`
+    // closure but widens to `string | undefined` when the handler is extracted
+    // into a free function with a generic `Context`. The route registration in
+    // `./crud.ts` guarantees presence; the `undefined` branch is impossible
+    // at runtime, so we fold it into the unknown_integration 404 to keep
+    // behavior byte-identical to the pre-split inline closure.
+    const key = c.req.param("key");
+    if (key === undefined || !isIntegrationKey(key)) {
+        return respondWithAgentError(c, 404, [
+            composeIssue("integrations.unknown_integration", {
+                field: "key",
+                received: key,
+            }),
+        ], { legacyFields: { key } });
+    }
+    const parsedBody = await readJsonBody(c);
+    if (!parsedBody.ok)
+        return parsedBody.response;
+    const parsed = integrationPatchSchema.safeParse(parsedBody.body);
+    if (!parsed.success) {
+        return c.json({
+            error: "validation_error",
+            issues: parsed.error.issues.map((i) => ({
+                path: i.path,
+                message: i.message,
+            })),
+        }, 400);
+    }
+    const descriptor = INTEGRATION_DESCRIPTORS[key];
+    if (!descriptor.supportedModes.includes(parsed.data.mode)) {
+        return c.json({
+            error: "unsupported_mode",
+            key,
+            mode: parsed.data.mode,
+            supportedModes: descriptor.supportedModes,
+        }, 400);
+    }
+    const previous = readIntegrations(db)[key];
+    // Compute the side-effect-relevant flags up-front:
+    //  - modeChanged: probe-cache eviction + lifecycle observer flip + variants
+    //    gate all key off this. A pure deniedTools edit must NOT trigger any of
+    //    them — those are mode-change concerns.
+    //  - effectiveBackend: which backend the post-PATCH state will run against
+    //    in `delegated` mode. Used for both the missing-variants gate and the
+    //    deniedTools validator. If the user omits delegatedBackend on a
+    //    delegated→delegated edit (e.g. just toggling tool permissions), we
+    //    keep the previous backend.
+    //  - effectiveNativeBackend: same shape for `native` mode
+    //    (INTEGRATION_NATIVE_MODE_DESIGN.md §11.2). Validated against the
+    //    current main backend below.
+    const modeChanged = parsed.data.mode !== previous.mode
+        || (parsed.data.delegatedBackend ?? null) !==
+            (previous.delegatedBackend ?? null)
+        || (parsed.data.nativeBackend ?? null) !==
+            (previous.nativeBackend ?? null);
+    const effectiveBackend = parsed.data.mode === "delegated"
+        ? (parsed.data.delegatedBackend ?? previous.delegatedBackend ?? null)
+        : null;
+    const effectiveNativeBackend = parsed.data.mode === "native"
+        ? (parsed.data.nativeBackend ?? previous.nativeBackend ?? null)
+        : null;
+    // INTEGRATION_NATIVE_MODE_DESIGN.md §11.2 — `native` mode validation.
+    // Runs BEFORE the delegated-mode validation block because native and
+    // delegated are mutually exclusive: a single PATCH cannot ask for both.
+    // The schema's `superRefine` already rejects co-occurring fields, but
+    // the explicit branch here surfaces a clearer error and runs the live
+    // probe + variant-file gate.
+    if (parsed.data.mode === "native") {
+        if (!effectiveNativeBackend) {
+            return c.json({
+                error: "validation_error",
+                issues: [
+                    {
+                        path: ["nativeBackend"],
+                        message: "nativeBackend is required when mode is 'native'",
+                    },
+                ],
+            }, 400);
+        }
+        const supported = supportedNativeBackends(key);
+        if (!supported.includes(effectiveNativeBackend)) {
+            // Descriptor-driven integrations only — user-managed descriptors
+            // pass automatically because `supportedNativeBackends` returns
+            // every registered backend for them (INTEGRATION_NATIVE_MODE_DESIGN.md
+            // §5.3 2026-05 amendment).
+            return c.json({
+                error: "backend_not_supported_native",
+                key,
+                backend: effectiveNativeBackend,
+                supportedNativeBackends: supported,
+                message: `Backend '${effectiveNativeBackend}' has no native connector for '${key}'. Native mode for this integration is offered only on backends that ship a registry connector.`,
+            }, 400);
+        }
+        // §3.3 invariant: native binds to the main backend. The setup wizard
+        // will hide the Native option entirely when the main backend doesn't
+        // appear in `supportedNativeBackends(key)`; this check is the API-
+        // layer defense against an out-of-band PATCH (CLI / curl).
+        const mainBackend = readMainBackend(db);
+        if (mainBackend !== null && effectiveNativeBackend !== mainBackend) {
+            return c.json({
+                error: "native_backend_mismatches_main",
+                key,
+                nativeBackend: effectiveNativeBackend,
+                mainBackend,
+                message: `Native mode binds to the main backend (${mainBackend}); refusing to set nativeBackend='${effectiveNativeBackend}'. Switch the main backend first (PUT /api/backends/main) or pick a different mode.`,
+            }, 400);
+        }
+        // §7.4 / §8.5 missing-variant gate. Only re-runs when this is an
+        // actual mode/binding change (a pure annotation PATCH on an already-
+        // native row leaves the variant set unchanged).
+        //
+        // User-managed connector integrations (e.g. Outlook) skip the
+        // descriptor-driven variant check — there is no daemon-shipped
+        // `SKILL.native.<backend>.md` for them. The user's MCP / skill
+        // harness on their backend is the authority, mirroring the
+        // delegated-mode path above. §5.3 (2026-05 amendment).
+        if (modeChanged && !descriptor.userManagedConnector) {
+            const missing = missingNativeVariants(config.workspaceDir, key, effectiveNativeBackend);
+            if (missing.skills.length > 0 || missing.taskFlows.length > 0) {
+                return c.json({
+                    error: "missing_variants",
+                    key,
+                    backend: effectiveNativeBackend,
+                    mode: "native",
+                    missingSkills: missing.skills,
+                    missingTaskFlows: missing.taskFlows,
+                    message: `Cannot enter native mode for '${key}' on backend '${effectiveNativeBackend}' — ${missing.skills.length + missing.taskFlows.length} variant file(s) missing. Phase B1 stubs every supported native variant; rebuild the package if your tree is stale.`,
+                }, 400);
+            }
+        }
+    }
+    if (parsed.data.mode === "delegated") {
+        if (!effectiveBackend) {
+            return c.json({
+                error: "validation_error",
+                issues: [{
+                        path: ["delegatedBackend"],
+                        message: "delegatedBackend is required when mode is 'delegated'",
+                    }],
+            }, 400);
+        }
+        // User-managed connector integrations (e.g. Outlook) skip the
+        // descriptor-driven connector check and the variant gate: the user
+        // installs an Outlook / Microsoft Graph MCP on their selected
+        // backend (Claude Code Connector / Codex MCP / Gemini extension)
+        // and the daemon trusts that wiring. Capability probing is the
+        // user's responsibility on the backend side.
+        if (!descriptor.userManagedConnector) {
+            if (!descriptor.backendConnectors[effectiveBackend]) {
+                return c.json({
+                    error: "backend_not_supported",
+                    key,
+                    backend: effectiveBackend,
+                    availableBackends: Object.keys(descriptor.backendConnectors),
+                }, 400);
+            }
+            // §4.7 "Missing-variant policy" — only re-run the gate when the user
+            // is actually changing mode or backend. A pure deniedTools edit on an
+            // already-delegated integration leaves the variant set unchanged, so
+            // re-walking the file system would be wasted work AND would surface a
+            // stale-during-author error if a variant was momentarily missing.
+            //
+            // DELEGATED-MODE-V2-DESIGN.md §11 (Phase 3) re-activated the
+            // legacy variant gate for every delegated integration. gmail and
+            // google_calendar now ship `SKILL.delegated.<sessionBackend>.md`
+            // (cross-backend) and resolve to `null` for same-backend, so
+            // missing variants are a real configuration error.
+            if (modeChanged) {
+                const missing = missingDelegatedVariants(config.workspaceDir, key, effectiveBackend);
+                if (missing.skills.length > 0 || missing.taskFlows.length > 0) {
+                    return c.json({
+                        error: "missing_variants",
+                        key,
+                        backend: effectiveBackend,
+                        missingSkills: missing.skills,
+                        missingTaskFlows: missing.taskFlows,
+                        message: `Cannot enter delegated mode for '${key}' on backend '${effectiveBackend}' — ${missing.skills.length + missing.taskFlows.length} variant file(s) missing. Author the listed files or narrow the registry's skillsTouched / taskFlowsTouched before retrying.`,
+                    }, 400);
+                }
+            }
+        }
+    }
+    // DELEGATED-PROXY-API-DESIGN.md §6.1 — `delegatedModel` validation.
+    // The schema rejects empty strings already; here we additionally
+    // reject values that don't appear in the registered model list for
+    // the effective backend (or in user-pinned `process_backend_config`
+    // rows for the same backend, per §4.2's "trust custom pins" rule).
+    // The value is *allowed* on any mode so the user can pre-stage a pin
+    // before flipping to delegated; validation only runs when we have a
+    // backend to validate against.
+    if (parsed.data.delegatedModel !== undefined
+        && parsed.data.delegatedModel !== null
+        && effectiveBackend) {
+        const candidate = parsed.data.delegatedModel;
+        if (!proxyModelIsKnown(db, effectiveBackend, candidate)) {
+            return c.json({
+                error: "unknown_model",
+                key,
+                backend: effectiveBackend,
+                model: candidate,
+                knownModels: knownProxyModels(db, effectiveBackend),
+                message: `Model '${candidate}' is not registered for backend '${effectiveBackend}'. Pick one of the known models or pass null to use the canonical light-tier default.`,
+            }, 400);
+        }
+    }
+    // §7.7 — `deniedTools` validation. We accept the field on any mode so
+    // the user can pre-stage a deny list before flipping to delegated, but
+    // validation only runs against the effective backend when one exists.
+    // For non-delegated modes, deniedTools persists as-is (no live backend
+    // to validate against — the value is inert until delegated).
+    //
+    // DELEGATED-MODE-V2-DESIGN.md §4.5.4 — first-time delegated setup
+    // pre-populates `deniedTools` with the recommended starter list when
+    // the caller didn't supply one (PATCH omits the field). This keeps the
+    // CLAUDE.md "destructive ops require user confirmation" invariant
+    // intact on a fresh install. The user opts out explicitly by passing
+    // `deniedTools: []` (empty array, distinct from undefined).
+    //
+    // The starter floor fires in two distinct shapes — both arrive at an
+    // effectively-empty deny set after the PATCH and would otherwise leave
+    // the agent unconstrained:
+    //
+    //   (a) Entering delegated mode for the first time on this integration
+    //       (previous mode was direct/disabled) AND no curated list was
+    //       already pre-staged — re-entry from disabled with prior denies
+    //       kept means the user already curated, don't overwrite.
+    //
+    //   (b) Backend swap (delegated → delegated, different `delegatedBackend`)
+    //       where every entry in `previous.deniedTools` is namespace-stale on
+    //       the new backend. The user's curation referenced tools the new
+    //       connector doesn't expose (e.g. Claude's `label_message` carried
+    //       into a Codex session), so the materializer's stale-drop pass
+    //       would empty the disallowedTools array silently — closing the
+    //       same §4.5.4 floor the design wrote (a) to defend. The original
+    //       design framed §4.5.4 as "first delegated setup only" and missed
+    //       this case; surfaced during the 2026-04-26 implementation review.
+    //
+    // The wizard UI for the opt-out / "use recommended" / "I'll edit"
+    // branches is Phase 4 polish (see §Phase 4.2). For now the API default
+    // closes the safety floor; the dashboard editor card surfaces the
+    // populated list for editing.
+    const enteringDelegated = parsed.data.mode === "delegated" && previous.mode !== "delegated";
+    const omittedDeniedTools = parsed.data.deniedTools === undefined;
+    const previousDeniedToolsEmpty = (previous.deniedTools ?? []).length === 0;
+    const swappingDelegatedBackend = parsed.data.mode === "delegated"
+        && previous.mode === "delegated"
+        && effectiveBackend !== null
+        && previous.delegatedBackend !== undefined
+        && previous.delegatedBackend !== effectiveBackend;
+    // For shape (b): the previous list had at least one entry (otherwise the
+    // floor was already empty and shape (a)'s logic doesn't apply here either),
+    // and *every* entry is stale on the new backend.
+    const swapWipesAllDenies = swappingDelegatedBackend
+        && (previous.deniedTools ?? []).length > 0
+        && filterDeniedToolsForBackend(key, effectiveBackend, 
+        /* c8 ignore next -- ?? [] unreachable: length > 0 guard above ensures non-empty array */
+        previous.deniedTools ?? []).active.length === 0;
+    const useStarter = effectiveBackend !== null
+        && omittedDeniedTools
+        && ((enteringDelegated && previousDeniedToolsEmpty)
+            || swapWipesAllDenies);
+    const finalDeniedTools = useStarter
+        ? recommendedStarterDeniedTools(key, effectiveBackend)
+        : parsed.data.deniedTools !== undefined
+            ? parsed.data.deniedTools
+            : (previous.deniedTools ?? []);
+    if (useStarter && finalDeniedTools.length > 0) {
+        logger.info({
+            key,
+            backend: effectiveBackend,
+            starter: finalDeniedTools,
+            // Distinguish the two shapes so log readers can spot the
+            // backend-swap fallback separately from first-time setup.
+            // `enteringDelegated` covers shape (a); `swapWipesAllDenies`
+            // covers shape (b). They are mutually exclusive by construction
+            // (a requires `previous.mode !== "delegated"`, b requires
+            // `previous.mode === "delegated"`).
+            trigger: enteringDelegated ? "first_delegated" : "backend_swap_stale",
+            previousBackend: swappingDelegatedBackend
+                ? previous.delegatedBackend
+                : null,
+        }, "applied starter deniedTools floor");
+    }
+    if (effectiveBackend && parsed.data.deniedTools !== undefined) {
+        const result = validateDeniedTools(key, effectiveBackend, finalDeniedTools);
+        if (!result.ok) {
+            if (result.error === "unknown_tool") {
+                return c.json({
+                    error: "unknown_tool",
+                    key,
+                    backend: effectiveBackend,
+                    tool: result.tool,
+                    knownTools: result.knownTools,
+                    message: `Tool '${result.tool}' is not declared in the ${effectiveBackend} connector for '${key}'. Pick a tool from the descriptor's capability list.`,
+                }, 400);
+            }
+            if (result.error === "denial_breaks_required_capability") {
+                return c.json({
+                    error: "denial_breaks_required_capability",
+                    key,
+                    backend: effectiveBackend,
+                    capability: result.capability,
+                    remainingTools: result.remainingTools,
+                    message: `Denying these tools removes the only path for required capability '${result.capability}'. Keep at least one of: ${result.remainingTools.join(", ")}.`,
+                }, 400);
+            }
+            // "no_connector" should be unreachable — we already validated
+            // `descriptor.backendConnectors[effectiveBackend]` above. Map to a
+            // 500 rather than a 400 because it indicates a server-side mismatch.
+            return respondWithAgentError(c, 500, [
+                composeIssue("integrations.internal_error", {
+                    field: "<server>",
+                    received: "<connector_mismatch>",
+                }),
+            ]);
+        }
+    }
+    // DELEGATED-PROXY-API-DESIGN.md §4.2 — `delegatedModel` carry-over
+    // rules:
+    //   - PATCH omits the field → preserve previous value (mode-flip
+    //     idempotent: direct ↔ delegated keeps the pin).
+    //   - PATCH passes `null` → clear the pin (canonical fallback at
+    //     call time). Surfaced by the dashboard's "Reset to default"
+    //     affordance after a backend swap.
+    //   - PATCH passes a non-empty string → validated above and stored.
+    // Same shape for `delegatedMaxTurns` (forward-compat — no UI yet).
+    const finalDelegatedModel = parsed.data.delegatedModel === undefined
+        ? (previous.delegatedModel ?? null)
+        : parsed.data.delegatedModel;
+    const finalDelegatedMaxTurns = parsed.data.delegatedMaxTurns === undefined
+        ? (previous.delegatedMaxTurns ?? null)
+        : parsed.data.delegatedMaxTurns;
+    const finalDelegatedSyncEnabled = parsed.data.delegatedSyncEnabled === undefined
+        ? previous.delegatedSyncEnabled
+        : parsed.data.delegatedSyncEnabled;
+    // INTEGRATION_NATIVE_MODE_DESIGN.md §19.4 — mirror of the delegated
+    // collapse: PATCH omits → preserve previous; PATCH passes a boolean
+    // → store. Accepted in any mode so the operator can pre-stage the
+    // setting before flipping `mode = "native"`.
+    const finalNativeSyncEnabled = parsed.data.nativeSyncEnabled === undefined
+        ? previous.nativeSyncEnabled
+        : parsed.data.nativeSyncEnabled;
+    const stamped = new Date().toISOString();
+    // INTEGRATION_NATIVE_MODE_DESIGN.md §11.3.1 — flip-lock orchestration.
+    // Only acquired when the mode or a backend binding is changing; pure
+    // annotation edits (deniedTools / delegatedModel) on an already-correct
+    // row don't need the lock because no observer / worker / session needs
+    // to drain. A concurrent flip on the same key (parallel PATCH from
+    // CLI + dashboard) is rejected with 409.
+    let flipLockHeld = false;
+    if (modeChanged) {
+        const acquire = acquireIntegrationFlipLock(db, key);
+        if (!acquire.ok) {
+            // §11.3.1 — concurrent flip on the same key. The expected hold
+            // window is short (probe + drain are both bounded by the 5s
+            // tick boundary), so signal the retry interval explicitly via
+            // `Retry-After`. Standards-compliant clients (and the dashboard's
+            // mode-dialog) honor this; the message body keeps the hold
+            // metadata for forensics.
+            c.header("Retry-After", "5");
+            return c.json({
+                error: "integration_flip_in_progress",
+                key,
+                heldBy: acquire.current,
+                retryAfterSeconds: 5,
+                message: `A mode flip for '${key}' is already in progress (acquired ${acquire.current.acquiredAt} by pid ${acquire.current.processId}). Retry in a few seconds.`,
+            }, 409);
+        }
+        flipLockHeld = true;
+    }
+    try {
+        const next = updateIntegrationState(db, key, {
+            mode: parsed.data.mode,
+            // Only carry delegatedBackend when mode is delegated. The schema
+            // already enforces presence in that branch (superRefine), so a
+            // direct/disabled flip drops it cleanly. Don't fall back to the
+            // previous value here — that breaks the delegated → direct path
+            // (the integration would keep its old backend forever).
+            ...(parsed.data.mode === "delegated" && parsed.data.delegatedBackend
+                ? { delegatedBackend: parsed.data.delegatedBackend }
+                : {}),
+            // INTEGRATION_NATIVE_MODE_DESIGN.md §5.2 — same shape for the
+            // nativeBackend column. Schema's `superRefine` enforces mutual
+            // exclusion with `delegatedBackend`.
+            ...(parsed.data.mode === "native" && effectiveNativeBackend
+                ? { nativeBackend: effectiveNativeBackend }
+                : {}),
+            // Always persist the resolved delegatedModel/delegatedMaxTurns —
+            // null clears, undefined was already collapsed above to the
+            // previous value or null. Keeps the JSON blob shape stable
+            // across PATCHes even when the field is inert (mode !== delegated).
+            ...(finalDelegatedModel !== null
+                ? { delegatedModel: finalDelegatedModel }
+                : {}),
+            ...(finalDelegatedMaxTurns !== null
+                ? { delegatedMaxTurns: finalDelegatedMaxTurns }
+                : {}),
+            ...(finalDelegatedSyncEnabled === false
+                ? { delegatedSyncEnabled: false }
+                : {}),
+            ...(finalNativeSyncEnabled === false
+                ? { nativeSyncEnabled: false }
+                : {}),
+            deniedTools: finalDeniedTools,
+            lastChangedAt: stamped,
+        });
+        await writeManagementMd(config.dataDir, next, {
+            externalObsidianVaultPath: config.externalObsidianVaultPath,
+            externalObsidianWatch: config.externalObsidianWatch,
+        });
+        // §4.11 probe-cache eviction is a *mode-change* concern. A pure
+        // deniedTools edit doesn't invalidate which capabilities the
+        // connector exposes — the live probe answer is identical, only what
+        // the agent is allowed to invoke from the skill body changes. So
+        // gate eviction on modeChanged.
+        if (modeChanged) {
+            const cleared = deleteProbesForIntegration(db, key);
+            if (cleared > 0) {
+                logger.info({ key, cleared }, "cleared stale probe cache after integration mode change");
+            }
+        }
+        // DELEGATED-MODE-V2-DESIGN.md §4.4 #2 — a deniedTools-only edit must
+        // also re-materialize active DM workdirs, since the per-session
+        // `disallowedTools` array (Claude SDK), admin-policy TOML (Gemini),
+        // and AGENTS.md prose block (Codex) are derived from `state.deniedTools`
+        // at materialization time. A stale workdir would leak the old policy
+        // into the next turn. We compute the policy diff up front so we can
+        // gate the lifecycle callback on it.
+        const policyDiff = diffDeniedTools(previous.deniedTools ?? [], next[key].deniedTools ?? []);
+        const policyChanged = policyDiff.added.length > 0 || policyDiff.removed.length > 0;
+        // Only `delegatedSyncEnabled` gates an observer-lifecycle
+        // re-evaluation — the predicate
+        // (`hasActiveDelegatedSyncIntegration`) ignores `nativeSyncEnabled`
+        // because the worker has no role in native mode (see appendix
+        // §"Polling, observers, and the hourly-check threshold"). The
+        // `nativeSyncEnabled` field is retained on the state row for
+        // schema compatibility but toggling it is inert today.
+        const syncChanged = (previous.delegatedSyncEnabled ?? true)
+            !== (next[key].delegatedSyncEnabled ?? true);
+        // §4.10 lifecycle step 4 — observer flip side of the callback is
+        // gated on `wasDirect !== isDirect` inside `applyIntegrationModeChange`,
+        // so calling it on a deniedTools-only edit is safe: observer
+        // start/stop is a no-op, only `rematerializeDmSessions` fires.
+        if ((modeChanged || policyChanged || syncChanged) && deps.onIntegrationModeChange) {
+            void Promise.resolve()
+                .then(() => deps.onIntegrationModeChange?.(key, previous, next[key]))
+                .catch((err) => {
+                logger.error({ err, key }, "integration mode-change side-effects failed — DB state already updated");
+            });
+        }
+        // §7.7 audit. Two distinct action types so log readers can filter:
+        //  - integration.mode_change: mode or delegatedBackend moved
+        //  - integration.policy_change: deniedTools diff (with no mode flip)
+        // Both can fire on a single PATCH when the user changes mode AND
+        // deniedTools simultaneously — that's intentional, the diff is at
+        // different granularities.
+        if (modeChanged) {
+            recordAuditModeChange(db, key, previous, next[key]);
+        }
+        if (policyChanged) {
+            recordAuditPolicyChange(db, key, policyDiff);
+        }
+        logger.info({
+            key,
+            from: previous.mode,
+            to: next[key].mode,
+            delegatedBackend: next[key].delegatedBackend,
+            nativeBackend: next[key].nativeBackend,
+            delegatedModelFrom: previous.delegatedModel ?? null,
+            delegatedModelTo: next[key].delegatedModel ?? null,
+            deniedToolsAdded: policyDiff.added,
+            deniedToolsRemoved: policyDiff.removed,
+        }, modeChanged
+            ? "integration mode updated"
+            : "integration policy updated (deniedTools / delegatedModel)");
+        // Auto-enable the global task-mode flag the first time *any*
+        // integration enters delegated mode. Rationale:
+        //   - The legacy `/integrations/:key/invoke` RPC is dead (commented
+        //     out 2026-05-01 in this same file); every delegated skill body
+        //     and task flow now talks to `/exec`.
+        //   - `/exec` is gated by `delegatedTaskModeEnabled`, originally a
+        //     Phase-1 canary that defaults `false`. With `/invoke` gone,
+        //     "delegated mode + task mode off" is a degenerate state with
+        //     no productive use — the agent calls `/exec`, gets 503,
+        //     fails. So flipping an integration to delegated *is* the
+        //     enablement signal.
+        //   - We only flip on the transition into delegated, not on every
+        //     PATCH against an already-delegated integration. A pure
+        //     deniedTools edit must not silently re-enable a flag the
+        //     operator manually toggled off; emergency-disable is the
+        //     flag's remaining role.
+        const enteringDelegated = next[key].mode === "delegated" && previous.mode !== "delegated";
+        if (enteringDelegated && !config.delegatedTaskModeEnabled) {
+            try {
+                createSettingsStore(db).set("delegatedTaskModeEnabled", true);
+                config.delegatedTaskModeEnabled = true;
+                logger.info({ key, backend: effectiveBackend, trigger: "first_delegated" }, "auto-enabled delegatedTaskModeEnabled — first delegated integration");
+                /* c8 ignore start -- settings write never fails with in-memory DB; defensive for production */
+            }
+            catch (err) {
+                logger.error({ err, key }, "failed to persist delegatedTaskModeEnabled auto-enable; in-memory config still updated");
+            }
+            /* c8 ignore stop */
+        }
+        return c.json({ ok: true, integration: next[key] });
+        /* c8 ignore start -- updateIntegrationState never throws with in-memory DB; defensive for production */
+    }
+    catch (err) {
+        logger.error({ err, key }, "integration mode update failed");
+        return respondWithAgentError(c, 500, [
+            composeIssue("integrations.internal_error", {
+                field: "<server>",
+                received: "<state_update_failed>",
+            }),
+        ]);
+        /* c8 ignore stop */
+    }
+    finally {
+        // §11.3.1 — release the flip lock regardless of success/failure so
+        // the next PATCH for this key is unblocked.
+        if (flipLockHeld) {
+            releaseIntegrationFlipLock(db, key);
+        }
+    }
+}
+function recordAuditModeChange(db, key, previous, next) {
+    try {
+        db.prepare(`INSERT INTO agent_actions
+         (event_id, action_type, trigger, result, detail, started_at, completed_at)
+       VALUES (?, 'integration.mode_change', 'reactive', 'success', ?, datetime('now'), datetime('now'))`).run(`integration:${key}:${Date.now()}`, JSON.stringify({
+            key,
+            from: {
+                mode: previous.mode,
+                delegatedBackend: previous.delegatedBackend ?? null,
+                // INTEGRATION_NATIVE_MODE_DESIGN.md §11.4 — preserve the prior
+                // native binding in the audit row so the forensic chain survives
+                // the schema clearing `nativeBackend` once mode flips away.
+                nativeBackend: previous.nativeBackend ?? null,
+            },
+            to: {
+                mode: next.mode,
+                delegatedBackend: next.delegatedBackend ?? null,
+                nativeBackend: next.nativeBackend ?? null,
+            },
+        }));
+        /* c8 ignore start -- in-memory DB always succeeds; catch is defensive for production DB errors */
+    }
+    catch (err) {
+        logger.warn({ err, key }, "failed to write integration audit row");
+    }
+    /* c8 ignore stop */
+}
+function recordAuditPolicyChange(db, key, diff) {
+    try {
+        db.prepare(`INSERT INTO agent_actions
+         (event_id, action_type, trigger, result, detail, started_at, completed_at)
+       VALUES (?, 'integration.policy_change', 'reactive', 'success', ?, datetime('now'), datetime('now'))`).run(`integration:${key}:policy:${Date.now()}`, JSON.stringify({ key, deniedTools: diff }));
+        /* c8 ignore start -- in-memory DB always succeeds; catch is defensive for production DB errors */
+    }
+    catch (err) {
+        logger.warn({ err, key }, "failed to write integration policy audit row");
+    }
+    /* c8 ignore stop */
+}
+function diffDeniedTools(previous, next) {
+    const prevSet = new Set(previous);
+    const nextSet = new Set(next);
+    const added = next.filter((t) => !prevSet.has(t));
+    const removed = previous.filter((t) => !nextSet.has(t));
+    return { added, removed };
+}
+//# sourceMappingURL=crud-patch.js.map

package/dist/api/routes/integrations/crud-patch.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"crud-patch.js","sourceRoot":"","sources":["../../../../src/api/routes/integrations/crud-patch.ts"],"names":[],"mappings":"AAEA,OAAO,EACL,uBAAuB,EACvB,2BAA2B,EAC3B,sBAAsB,EACtB,gBAAgB,EAChB,6BAA6B,EAC7B,uBAAuB,EACvB,mBAAmB,GAGpB,MAAM,eAAe,CAAC;AACvB,OAAO,EACL,gBAAgB,EAChB,sBAAsB,GACvB,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAC;AACnE,OAAO,EACL,wBAAwB,EACxB,qBAAqB,GACtB,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EACL,0BAA0B,EAC1B,0BAA0B,GAC3B,MAAM,wCAAwC,CAAC;AAChD,OAAO,EAAE,eAAe,EAAE,MAAM,2CAA2C,CAAC;AAC5E,OAAO,EAAE,0BAA0B,EAAE,MAAM,wCAAwC,CAAC;AACpF,OAAO,EACL,gBAAgB,EAChB,iBAAiB,GAClB,MAAM,gDAAgD,CAAC;AACxD,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACnD,OAAO,EAAE,YAAY,EAAE,qBAAqB,EAAE,MAAM,+BAA+B,CAAC;AACpF,OAAO,EAAE,mBAAmB,EAAE,MAAM,qCAAqC,CAAC;AAG1E,MAAM,MAAM,GAAG,YAAY,CAAC,kBAAkB,CAAC,CAAC;AAEhD;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,CAAU,EACV,IAAqB;IAErB,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;IAC5B,6EAA6E;IAC7E,2EAA2E;IAC3E,2EAA2E;IAC3E,wEAAwE;IACxE,qEAAqE;IACrE,2DAA2D;IAC3D,MAAM,GAAG,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAC/B,IAAI,GAAG,KAAK,SAAS,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,EAAE,CAAC;QAChD,OAAO,qBAAqB,CAAC,CAAC,EAAE,GAAG,EAAE;YACnC,YAAY,CAAC,kCAAkC,EAAE;gBAC/C,KAAK,EAAE,KAAK;gBACZ,QAAQ,EAAE,GAAG;aACd,CAAC;SACH,EAAE,EAAE,YAAY,EAAE,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;IAChC,CAAC;IAED,MAAM,UAAU,GAAG,MAAM,YAAY,CAAC,CAAC,CAAC,CAAC;IACzC,IAAI,CAAC,UAAU,CAAC,EAAE;QAAE,OAAO,UAAU,CAAC,QAAQ,CAAC;IAE/C,MAAM,MAAM,GAAG,sBAAsB,CAAC,SAAS,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;IACjE,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,OAAO,CAAC,CAAC,IAAI,CACX;YACE,KAAK,EAAE,kBAAkB;YACzB,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;gBACtC,IAAI,EAAE,CAAC,CAAC,IAAI;gBACZ,OAAO,EAAE,CAAC,CAAC,OAAO;aACnB,CAAC,CAAC;SACJ,EACD,GAAG,CACJ,CAAC;IACJ,CAAC;IAED,MAAM,UAAU,GAAG,uBAAuB,CAAC,GAAG,CAAC,CAAC;IAChD,IAAI,CAAC,UAAU,CAAC,cAAc,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAC1D,OAAO,CAAC,CAAC,IAAI,CACX;YACE,KAAK,EAAE,kBAAkB;YACzB,GAAG;YACH,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI;YACtB,cAAc,EAAE,UAAU,CAAC,cAAc;SAC1C,EACD,GAAG,CACJ,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAG,gBAAgB,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC;IAE3C,mDAAmD;IACnD,4EAA4E;IAC5E,4EAA4E;IAC5E,4CAA4C;IAC5C,2EAA2E;IAC3E,0EAA0E;IAC1E,oEAAoE;IACpE,wEAAwE;IACxE,gCAAgC;IAChC,0DAA0D;IAC1D,sEAAsE;IACtE,iCAAiC;IACjC,MAAM,WAAW,GACf,MAAM,CAAC,IAAI,CAAC,IAAI,KAAK,QAAQ,CAAC,IAAI;WAC/B,CAAC,MAAM,CAAC,IAAI,CAAC,gBAAgB,IAAI,IAAI,CAAC;YACvC,CAAC,QAAQ,CAAC,gBAAgB,IAAI,IAAI,CAAC;WAClC,CAAC,MAAM,CAAC,IAAI,CAAC,aAAa,IAAI,IAAI,CAAC;YACpC,CAAC,QAAQ,CAAC,aAAa,IAAI,IAAI,CAAC,CAAC;IACrC,MAAM,gBAAgB,GACpB,MAAM,CAAC,IAAI,CAAC,IAAI,KAAK,WAAW;QAC9B,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,gBAAgB,IAAI,QAAQ,CAAC,gBAAgB,IAAI,IAAI,CAAC;QACrE,CAAC,CAAC,IAAI,CAAC;IACX,MAAM,sBAAsB,GAC1B,MAAM,CAAC,IAAI,CAAC,IAAI,KAAK,QAAQ;QAC3B,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,aAAa,IAAI,QAAQ,CAAC,aAAa,IAAI,IAAI,CAAC;QAC/D,CAAC,CAAC,IAAI,CAAC;IAEX,sEAAsE;IACtE,qEAAqE;IACrE,wEAAwE;IACxE,sEAAsE;IACtE,sEAAsE;IACtE,6BAA6B;IAC7B,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QAClC,IAAI,CAAC,sBAAsB,EAAE,CAAC;YAC5B,OAAO,CAAC,CAAC,IAAI,CACX;gBACE,KAAK,EAAE,kBAAkB;gBACzB,MAAM,EAAE;oBACN;wBACE,IAAI,EAAE,CAAC,eAAe,CAAC;wBACvB,OAAO,EAAE,iDAAiD;qBAC3D;iBACF;aACF,EACD,GAAG,CACJ,CAAC;QACJ,CAAC;QAED,MAAM,SAAS,GAAG,uBAAuB,CAAC,GAAG,CAAC,CAAC;QAC/C,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,sBAAsB,CAAC,EAAE,CAAC;YAChD,iEAAiE;YACjE,+DAA+D;YAC/D,uEAAuE;YACvE,2BAA2B;YAC3B,OAAO,CAAC,CAAC,IAAI,CACX;gBACE,KAAK,EAAE,8BAA8B;gBACrC,GAAG;gBACH,OAAO,EAAE,sBAAsB;gBAC/B,uBAAuB,EAAE,SAAS;gBAClC,OAAO,EAAE,YAAY,sBAAsB,kCAAkC,GAAG,iGAAiG;aAClL,EACD,GAAG,CACJ,CAAC;QACJ,CAAC;QAED,qEAAqE;QACrE,qEAAqE;QACrE,mEAAmE;QACnE,2DAA2D;QAC3D,MAAM,WAAW,GAAG,eAAe,CAAC,EAAE,CAAC,CAAC;QACxC,IAAI,WAAW,KAAK,IAAI,IAAI,sBAAsB,KAAK,WAAW,EAAE,CAAC;YACnE,OAAO,CAAC,CAAC,IAAI,CACX;gBACE,KAAK,EAAE,gCAAgC;gBACvC,GAAG;gBACH,aAAa,EAAE,sBAAsB;gBACrC,WAAW;gBACX,OAAO,EAAE,0CAA0C,WAAW,qCAAqC,sBAAsB,qFAAqF;aAC/M,EACD,GAAG,CACJ,CAAC;QACJ,CAAC;QAED,iEAAiE;QACjE,qEAAqE;QACrE,gDAAgD;QAChD,EAAE;QACF,8DAA8D;QAC9D,+DAA+D;QAC/D,+DAA+D;QAC/D,2DAA2D;QAC3D,uDAAuD;QACvD,IAAI,WAAW,IAAI,CAAC,UAAU,CAAC,oBAAoB,EAAE,CAAC;YACpD,MAAM,OAAO,GAAG,qBAAqB,CACnC,MAAM,CAAC,YAAY,EACnB,GAAG,EACH,sBAAsB,CACvB,CAAC;YACF,IAAI,OAAO,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,IAAI,OAAO,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC9D,OAAO,CAAC,CAAC,IAAI,CACX;oBACE,KAAK,EAAE,kBAAkB;oBACzB,GAAG;oBACH,OAAO,EAAE,sBAAsB;oBAC/B,IAAI,EAAE,QAAQ;oBACd,aAAa,EAAE,OAAO,CAAC,MAAM;oBAC7B,gBAAgB,EAAE,OAAO,CAAC,SAAS;oBACnC,OAAO,EAAE,iCAAiC,GAAG,iBAAiB,sBAAsB,OAAO,OAAO,CAAC,MAAM,CAAC,MAAM,GAAG,OAAO,CAAC,SAAS,CAAC,MAAM,qHAAqH;iBACjQ,EACD,GAAG,CACJ,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;IAED,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;QACrC,IAAI,CAAC,gBAAgB,EAAE,CAAC;YACtB,OAAO,CAAC,CAAC,IAAI,CACX;gBACE,KAAK,EAAE,kBAAkB;gBACzB,MAAM,EAAE,CAAC;wBACP,IAAI,EAAE,CAAC,kBAAkB,CAAC;wBAC1B,OAAO,EAAE,uDAAuD;qBACjE,CAAC;aACH,EACD,GAAG,CACJ,CAAC;QACJ,CAAC;QACD,8DAA8D;QAC9D,mEAAmE;QACnE,8DAA8D;QAC9D,iEAAiE;QACjE,+DAA+D;QAC/D,6CAA6C;QAC7C,IAAI,CAAC,UAAU,CAAC,oBAAoB,EAAE,CAAC;YACrC,IAAI,CAAC,UAAU,CAAC,iBAAiB,CAAC,gBAAgB,CAAC,EAAE,CAAC;gBACpD,OAAO,CAAC,CAAC,IAAI,CACX;oBACE,KAAK,EAAE,uBAAuB;oBAC9B,GAAG;oBACH,OAAO,EAAE,gBAAgB;oBACzB,iBAAiB,EAAE,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,iBAAiB,CAAC;iBAC7D,EACD,GAAG,CACJ,CAAC;YACJ,CAAC;YAED,qEAAqE;YACrE,sEAAsE;YACtE,qEAAqE;YACrE,sEAAsE;YACtE,kEAAkE;YAClE,EAAE;YACF,6DAA6D;YAC7D,iEAAiE;YACjE,iEAAiE;YACjE,6DAA6D;YAC7D,mDAAmD;YACnD,IAAI,WAAW,EAAE,CAAC;gBAChB,MAAM,OAAO,GAAG,wBAAwB,CACtC,MAAM,CAAC,YAAY,EACnB,GAAG,EACH,gBAAgB,CACjB,CAAC;gBACF,IAAI,OAAO,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,IAAI,OAAO,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;oBAC9D,OAAO,CAAC,CAAC,IAAI,CACX;wBACE,KAAK,EAAE,kBAAkB;wBACzB,GAAG;wBACH,OAAO,EAAE,gBAAgB;wBACzB,aAAa,EAAE,OAAO,CAAC,MAAM;wBAC7B,gBAAgB,EAAE,OAAO,CAAC,SAAS;wBACnC,OAAO,EACL,oCAAoC,GAAG,iBAAiB,gBAAgB,OAAO,OAAO,CAAC,MAAM,CAAC,MAAM,GAAG,OAAO,CAAC,SAAS,CAAC,MAAM,8HAA8H;qBAChQ,EACD,GAAG,CACJ,CAAC;gBACJ,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED,oEAAoE;IACpE,iEAAiE;IACjE,mEAAmE;IACnE,oEAAoE;IACpE,mEAAmE;IACnE,qEAAqE;IACrE,oEAAoE;IACpE,+BAA+B;IAC/B,IACE,MAAM,CAAC,IAAI,CAAC,cAAc,KAAK,SAAS;WACrC,MAAM,CAAC,IAAI,CAAC,cAAc,KAAK,IAAI;WACnC,gBAAgB,EACnB,CAAC;QACD,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC;QAC7C,IAAI,CAAC,iBAAiB,CAAC,EAAE,EAAE,gBAAgB,EAAE,SAAS,CAAC,EAAE,CAAC;YACxD,OAAO,CAAC,CAAC,IAAI,CACX;gBACE,KAAK,EAAE,eAAe;gBACtB,GAAG;gBACH,OAAO,EAAE,gBAAgB;gBACzB,KAAK,EAAE,SAAS;gBAChB,WAAW,EAAE,gBAAgB,CAAC,EAAE,EAAE,gBAAgB,CAAC;gBACnD,OAAO,EAAE,UAAU,SAAS,oCAAoC,gBAAgB,uFAAuF;aACxK,EACD,GAAG,CACJ,CAAC;QACJ,CAAC;IACH,CAAC;IAED,sEAAsE;IACtE,uEAAuE;IACvE,sEAAsE;IACtE,uEAAuE;IACvE,6DAA6D;IAC7D,EAAE;IACF,kEAAkE;IAClE,qEAAqE;IACrE,uEAAuE;IACvE,kEAAkE;IAClE,qEAAqE;IACrE,4DAA4D;IAC5D,EAAE;IACF,qEAAqE;IACrE,uEAAuE;IACvE,2BAA2B;IAC3B,EAAE;IACF,uEAAuE;IACvE,oEAAoE;IACpE,sEAAsE;IACtE,8DAA8D;IAC9D,EAAE;IACF,2EAA2E;IAC3E,0EAA0E;IAC1E,sEAAsE;IACtE,wEAAwE;IACxE,qEAAqE;IACrE,qEAAqE;IACrE,uEAAuE;IACvE,wEAAwE;IACxE,yEAAyE;IACzE,EAAE;IACF,kEAAkE;IAClE,uEAAuE;IACvE,kEAAkE;IAClE,8BAA8B;IAC9B,MAAM,iBAAiB,GACrB,MAAM,CAAC,IAAI,CAAC,IAAI,KAAK,WAAW,IAAI,QAAQ,CAAC,IAAI,KAAK,WAAW,CAAC;IACpE,MAAM,kBAAkB,GAAG,MAAM,CAAC,IAAI,CAAC,WAAW,KAAK,SAAS,CAAC;IACjE,MAAM,wBAAwB,GAAG,CAAC,QAAQ,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC;IAC3E,MAAM,wBAAwB,GAC5B,MAAM,CAAC,IAAI,CAAC,IAAI,KAAK,WAAW;WAC7B,QAAQ,CAAC,IAAI,KAAK,WAAW;WAC7B,gBAAgB,KAAK,IAAI;WACzB,QAAQ,CAAC,gBAAgB,KAAK,SAAS;WACvC,QAAQ,CAAC,gBAAgB,KAAK,gBAAgB,CAAC;IACpD,yEAAyE;IACzE,4EAA4E;IAC5E,iDAAiD;IACjD,MAAM,kBAAkB,GACtB,wBAAwB;WACrB,CAAC,QAAQ,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC,MAAM,GAAG,CAAC;WACvC,2BAA2B,CACzB,GAAG,EACH,gBAAiB;QACjB,yFAAyF;QACzF,QAAQ,CAAC,WAAW,IAAI,EAAE,CAC3B,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC;IAC3B,MAAM,UAAU,GACd,gBAAgB,KAAK,IAAI;WACtB,kBAAkB;WAClB,CACD,CAAC,iBAAiB,IAAI,wBAAwB,CAAC;eAC5C,kBAAkB,CACtB,CAAC;IACJ,MAAM,gBAAgB,GAAG,UAAU;QACjC,CAAC,CAAC,6BAA6B,CAAC,GAAG,EAAE,gBAAiB,CAAC;QACvD,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,KAAK,SAAS;YACrC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW;YACzB,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC;IACnC,IAAI,UAAU,IAAI,gBAAgB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC9C,MAAM,CAAC,IAAI,CACT;YACE,GAAG;YACH,OAAO,EAAE,gBAAgB;YACzB,OAAO,EAAE,gBAAgB;YACzB,yDAAyD;YACzD,0DAA0D;YAC1D,6DAA6D;YAC7D,gEAAgE;YAChE,0DAA0D;YAC1D,oCAAoC;YACpC,OAAO,EAAE,iBAAiB,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,oBAAoB;YACrE,eAAe,EAAE,wBAAwB;gBACvC,CAAC,CAAC,QAAQ,CAAC,gBAAgB;gBAC3B,CAAC,CAAC,IAAI;SACT,EACD,mCAAmC,CACpC,CAAC;IACJ,CAAC;IAED,IAAI,gBAAgB,IAAI,MAAM,CAAC,IAAI,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;QAC9D,MAAM,MAAM,GAAG,mBAAmB,CAChC,GAAG,EACH,gBAAgB,EAChB,gBAAgB,CACjB,CAAC;QACF,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;YACf,IAAI,MAAM,CAAC,KAAK,KAAK,cAAc,EAAE,CAAC;gBACpC,OAAO,CAAC,CAAC,IAAI,CACX;oBACE,KAAK,EAAE,cAAc;oBACrB,GAAG;oBACH,OAAO,EAAE,gBAAgB;oBACzB,IAAI,EAAE,MAAM,CAAC,IAAI;oBACjB,UAAU,EAAE,MAAM,CAAC,UAAU;oBAC7B,OAAO,EAAE,SAAS,MAAM,CAAC,IAAI,4BAA4B,gBAAgB,mBAAmB,GAAG,uDAAuD;iBACvJ,EACD,GAAG,CACJ,CAAC;YACJ,CAAC;YACD,IAAI,MAAM,CAAC,KAAK,KAAK,mCAAmC,EAAE,CAAC;gBACzD,OAAO,CAAC,CAAC,IAAI,CACX;oBACE,KAAK,EAAE,mCAAmC;oBAC1C,GAAG;oBACH,OAAO,EAAE,gBAAgB;oBACzB,UAAU,EAAE,MAAM,CAAC,UAAU;oBAC7B,cAAc,EAAE,MAAM,CAAC,cAAc;oBACrC,OAAO,EAAE,sEAAsE,MAAM,CAAC,UAAU,4BAA4B,MAAM,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;iBAChK,EACD,GAAG,CACJ,CAAC;YACJ,CAAC;YACD,8DAA8D;YAC9D,mEAAmE;YACnE,qEAAqE;YACrE,OAAO,qBAAqB,CAAC,CAAC,EAAE,GAAG,EAAE;gBACnC,YAAY,CAAC,6BAA6B,EAAE;oBAC1C,KAAK,EAAE,UAAU;oBACjB,QAAQ,EAAE,sBAAsB;iBACjC,CAAC;aACH,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,mEAAmE;IACnE,SAAS;IACT,iEAAiE;IACjE,qDAAqD;IACrD,iEAAiE;IACjE,iEAAiE;IACjE,uCAAuC;IACvC,oEAAoE;IACpE,mEAAmE;IACnE,MAAM,mBAAmB,GACvB,MAAM,CAAC,IAAI,CAAC,cAAc,KAAK,SAAS;QACtC,CAAC,CAAC,CAAC,QAAQ,CAAC,cAAc,IAAI,IAAI,CAAC;QACnC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC;IACjC,MAAM,sBAAsB,GAC1B,MAAM,CAAC,IAAI,CAAC,iBAAiB,KAAK,SAAS;QACzC,CAAC,CAAC,CAAC,QAAQ,CAAC,iBAAiB,IAAI,IAAI,CAAC;QACtC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,iBAAiB,CAAC;IACpC,MAAM,yBAAyB,GAC7B,MAAM,CAAC,IAAI,CAAC,oBAAoB,KAAK,SAAS;QAC5C,CAAC,CAAC,QAAQ,CAAC,oBAAoB;QAC/B,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,oBAAoB,CAAC;IACvC,oEAAoE;IACpE,oEAAoE;IACpE,kEAAkE;IAClE,6CAA6C;IAC7C,MAAM,sBAAsB,GAC1B,MAAM,CAAC,IAAI,CAAC,iBAAiB,KAAK,SAAS;QACzC,CAAC,CAAC,QAAQ,CAAC,iBAAiB;QAC5B,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,iBAAiB,CAAC;IAEpC,MAAM,OAAO,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAEzC,uEAAuE;IACvE,qEAAqE;IACrE,wEAAwE;IACxE,uEAAuE;IACvE,mEAAmE;IACnE,yCAAyC;IACzC,IAAI,YAAY,GAAG,KAAK,CAAC;IACzB,IAAI,WAAW,EAAE,CAAC;QAChB,MAAM,OAAO,GAAG,0BAA0B,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;QACpD,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;YAChB,+DAA+D;YAC/D,4DAA4D;YAC5D,8DAA8D;YAC9D,kEAAkE;YAClE,2DAA2D;YAC3D,0BAA0B;YAC1B,CAAC,CAAC,MAAM,CAAC,aAAa,EAAE,GAAG,CAAC,CAAC;YAC7B,OAAO,CAAC,CAAC,IAAI,CACX;gBACE,KAAK,EAAE,8BAA8B;gBACrC,GAAG;gBACH,MAAM,EAAE,OAAO,CAAC,OAAO;gBACvB,iBAAiB,EAAE,CAAC;gBACpB,OAAO,EAAE,oBAAoB,GAAG,sCAAsC,OAAO,CAAC,OAAO,CAAC,UAAU,WAAW,OAAO,CAAC,OAAO,CAAC,SAAS,4BAA4B;aACjK,EACD,GAAG,CACJ,CAAC;QACJ,CAAC;QACD,YAAY,GAAG,IAAI,CAAC;IACtB,CAAC;IAED,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,sBAAsB,CAAC,EAAE,EAAE,GAAG,EAAE;YAC3C,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI;YACtB,iEAAiE;YACjE,+DAA+D;YAC/D,gEAAgE;YAChE,gEAAgE;YAChE,wDAAwD;YACxD,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,KAAK,WAAW,IAAI,MAAM,CAAC,IAAI,CAAC,gBAAgB;gBAClE,CAAC,CAAC,EAAE,gBAAgB,EAAE,MAAM,CAAC,IAAI,CAAC,gBAAgB,EAAE;gBACpD,CAAC,CAAC,EAAE,CAAC;YACP,8DAA8D;YAC9D,+DAA+D;YAC/D,qCAAqC;YACrC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,KAAK,QAAQ,IAAI,sBAAsB;gBACzD,CAAC,CAAC,EAAE,aAAa,EAAE,sBAAsB,EAAE;gBAC3C,CAAC,CAAC,EAAE,CAAC;YACP,iEAAiE;YACjE,4DAA4D;YAC5D,2DAA2D;YAC3D,oEAAoE;YACpE,GAAG,CAAC,mBAAmB,KAAK,IAAI;gBAC9B,CAAC,CAAC,EAAE,cAAc,EAAE,mBAAmB,EAAE;gBACzC,CAAC,CAAC,EAAE,CAAC;YACP,GAAG,CAAC,sBAAsB,KAAK,IAAI;gBACjC,CAAC,CAAC,EAAE,iBAAiB,EAAE,sBAAsB,EAAE;gBAC/C,CAAC,CAAC,EAAE,CAAC;YACP,GAAG,CAAC,yBAAyB,KAAK,KAAK;gBACrC,CAAC,CAAC,EAAE,oBAAoB,EAAE,KAAK,EAAE;gBACjC,CAAC,CAAC,EAAE,CAAC;YACP,GAAG,CAAC,sBAAsB,KAAK,KAAK;gBAClC,CAAC,CAAC,EAAE,iBAAiB,EAAE,KAAK,EAAE;gBAC9B,CAAC,CAAC,EAAE,CAAC;YACP,WAAW,EAAE,gBAAgB;YAC7B,aAAa,EAAE,OAAO;SACvB,CAAC,CAAC;QAEH,MAAM,iBAAiB,CAAC,MAAM,CAAC,OAAO,EAAE,IAAI,EAAE;YAC5C,yBAAyB,EAAE,MAAM,CAAC,yBAAyB;YAC3D,qBAAqB,EAAE,MAAM,CAAC,qBAAqB;SACpD,CAAC,CAAC;QAEH,gEAAgE;QAChE,6DAA6D;QAC7D,oEAAoE;QACpE,iEAAiE;QACjE,gCAAgC;QAChC,IAAI,WAAW,EAAE,CAAC;YAChB,MAAM,OAAO,GAAG,0BAA0B,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;YACpD,IAAI,OAAO,GAAG,CAAC,EAAE,CAAC;gBAChB,MAAM,CAAC,IAAI,CACT,EAAE,GAAG,EAAE,OAAO,EAAE,EAChB,yDAAyD,CAC1D,CAAC;YACJ,CAAC;QACH,CAAC;QAED,qEAAqE;QACrE,gEAAgE;QAChE,oEAAoE;QACpE,yEAAyE;QACzE,qEAAqE;QACrE,oEAAoE;QACpE,qCAAqC;QACrC,MAAM,UAAU,GAAG,eAAe,CAChC,QAAQ,CAAC,WAAW,IAAI,EAAE,EAC1B,IAAI,CAAC,GAAG,CAAC,CAAC,WAAW,IAAI,EAAE,CAC5B,CAAC;QACF,MAAM,aAAa,GACjB,UAAU,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,UAAU,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC;QAC/D,0DAA0D;QAC1D,gCAAgC;QAChC,oEAAoE;QACpE,8DAA8D;QAC9D,8DAA8D;QAC9D,6DAA6D;QAC7D,uDAAuD;QACvD,MAAM,WAAW,GACf,CAAC,QAAQ,CAAC,oBAAoB,IAAI,IAAI,CAAC;gBACnC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,oBAAoB,IAAI,IAAI,CAAC,CAAC;QAE/C,iEAAiE;QACjE,yEAAyE;QACzE,6DAA6D;QAC7D,+DAA+D;QAC/D,IAAI,CAAC,WAAW,IAAI,aAAa,IAAI,WAAW,CAAC,IAAI,IAAI,CAAC,uBAAuB,EAAE,CAAC;YAClF,KAAK,OAAO,CAAC,OAAO,EAAE;iBACnB,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,uBAAuB,EAAE,CAAC,GAAG,EAAE,QAAQ,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;iBACpE,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;gBACb,MAAM,CAAC,KAAK,CACV,EAAE,GAAG,EAAE,GAAG,EAAE,EACZ,wEAAwE,CACzE,CAAC;YACJ,CAAC,CAAC,CAAC;QACP,CAAC;QAED,mEAAmE;QACnE,6DAA6D;QAC7D,qEAAqE;QACrE,iEAAiE;QACjE,kEAAkE;QAClE,2BAA2B;QAC3B,IAAI,WAAW,EAAE,CAAC;YAChB,qBAAqB,CAAC,EAAE,EAAE,GAAG,EAAE,QAAQ,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;QACtD,CAAC;QACD,IAAI,aAAa,EAAE,CAAC;YAClB,uBAAuB,CAAC,EAAE,EAAE,GAAG,EAAE,UAAU,CAAC,CAAC;QAC/C,CAAC;QAED,MAAM,CAAC,IAAI,CACT;YACE,GAAG;YACH,IAAI,EAAE,QAAQ,CAAC,IAAI;YACnB,EAAE,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI;YAClB,gBAAgB,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,gBAAgB;YAC5C,aAAa,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,aAAa;YACtC,kBAAkB,EAAE,QAAQ,CAAC,cAAc,IAAI,IAAI;YACnD,gBAAgB,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,cAAc,IAAI,IAAI;YAClD,gBAAgB,EAAE,UAAU,CAAC,KAAK;YAClC,kBAAkB,EAAE,UAAU,CAAC,OAAO;SACvC,EACD,WAAW;YACT,CAAC,CAAC,0BAA0B;YAC5B,CAAC,CAAC,2DAA2D,CAChE,CAAC;QAEF,6DAA6D;QAC7D,gDAAgD;QAChD,oEAAoE;QACpE,oEAAoE;QACpE,0CAA0C;QAC1C,mEAAmE;QACnE,iEAAiE;QACjE,kEAAkE;QAClE,6DAA6D;QAC7D,8DAA8D;QAC9D,yBAAyB;QACzB,kEAAkE;QAClE,6DAA6D;QAC7D,8DAA8D;QAC9D,8DAA8D;QAC9D,6BAA6B;QAC7B,MAAM,iBAAiB,GACrB,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,KAAK,WAAW,IAAI,QAAQ,CAAC,IAAI,KAAK,WAAW,CAAC;QAClE,IAAI,iBAAiB,IAAI,CAAC,MAAM,CAAC,wBAAwB,EAAE,CAAC;YAC1D,IAAI,CAAC;gBACH,mBAAmB,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,0BAA0B,EAAE,IAAI,CAAC,CAAC;gBAC7D,MAAgD,CAAC,wBAAwB,GAAG,IAAI,CAAC;gBAClF,MAAM,CAAC,IAAI,CACT,EAAE,GAAG,EAAE,OAAO,EAAE,gBAAgB,EAAE,OAAO,EAAE,iBAAiB,EAAE,EAC9D,qEAAqE,CACtE,CAAC;gBACJ,+FAA+F;YAC/F,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,CAAC,KAAK,CACV,EAAE,GAAG,EAAE,GAAG,EAAE,EACZ,wFAAwF,CACzF,CAAC;YACJ,CAAC;YACD,oBAAoB;QACtB,CAAC;QAED,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACtD,wGAAwG;IACxG,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE,gCAAgC,CAAC,CAAC;QAC7D,OAAO,qBAAqB,CAAC,CAAC,EAAE,GAAG,EAAE;YACnC,YAAY,CAAC,6BAA6B,EAAE;gBAC1C,KAAK,EAAE,UAAU;gBACjB,QAAQ,EAAE,uBAAuB;aAClC,CAAC;SACH,CAAC,CAAC;QACL,oBAAoB;IACpB,CAAC;YAAS,CAAC;QACT,mEAAmE;QACnE,4CAA4C;QAC5C,IAAI,YAAY,EAAE,CAAC;YACjB,0BAA0B,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;QACtC,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,qBAAqB,CAC5B,EAAqB,EACrB,GAAmB,EACnB,QAIC,EACD,IAIC;IAED,IAAI,CAAC;QACH,EAAE,CAAC,OAAO,CACR;;yGAEmG,CACpG,CAAC,GAAG,CACH,eAAe,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,EAAE,EAClC,IAAI,CAAC,SAAS,CAAC;YACb,GAAG;YACH,IAAI,EAAE;gBACJ,IAAI,EAAE,QAAQ,CAAC,IAAI;gBACnB,gBAAgB,EAAE,QAAQ,CAAC,gBAAgB,IAAI,IAAI;gBACnD,+DAA+D;gBAC/D,iEAAiE;gBACjE,4DAA4D;gBAC5D,aAAa,EAAE,QAAQ,CAAC,aAAa,IAAI,IAAI;aAC9C;YACD,EAAE,EAAE;gBACF,IAAI,EAAE,IAAI,CAAC,IAAI;gBACf,gBAAgB,EAAE,IAAI,CAAC,gBAAgB,IAAI,IAAI;gBAC/C,aAAa,EAAE,IAAI,CAAC,aAAa,IAAI,IAAI;aAC1C;SACF,CAAC,CACH,CAAC;QACJ,kGAAkG;IAClG,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE,uCAAuC,CAAC,CAAC;IACrE,CAAC;IACD,oBAAoB;AACtB,CAAC;AAED,SAAS,uBAAuB,CAC9B,EAAqB,EACrB,GAAmB,EACnB,IAA4C;IAE5C,IAAI,CAAC;QACH,EAAE,CAAC,OAAO,CACR;;2GAEqG,CACtG,CAAC,GAAG,CACH,eAAe,GAAG,WAAW,IAAI,CAAC,GAAG,EAAE,EAAE,EACzC,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAC3C,CAAC;QACJ,kGAAkG;IAClG,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE,8CAA8C,CAAC,CAAC;IAC5E,CAAC;IACD,oBAAoB;AACtB,CAAC;AAED,SAAS,eAAe,CACtB,QAA2B,EAC3B,IAAuB;IAEvB,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC;IAClC,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC;IAC9B,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IAClD,MAAM,OAAO,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IACxD,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;AAC5B,CAAC"}

package/dist/api/routes/integrations/crud.d.ts

@@ -0,0 +1,16 @@
+import type { Hono } from "hono";
+import type { ApiDependencies } from "../../server.js";
+/**
+ * Register the integration CRUD routes:
+ *   - `GET    /integrations`
+ *   - `GET    /integrations/:key/recent-proxy-calls`
+ *   - `GET    /integrations/proxy-models/:backend`
+ *   - `PATCH  /integrations/:key`
+ *
+ * PATCH body lives in `./crud-patch.ts:handleIntegrationPatch` because the
+ * full lifecycle (validate / flip-lock / probe-cache / re-materialise /
+ * audit) is ~700 lines and would push this file past the ~800-line soft
+ * ceiling.
+ */
+export declare function registerCrudRoutes(app: Hono, deps: ApiDependencies): void;
+//# sourceMappingURL=crud.d.ts.map

package/dist/api/routes/integrations/crud.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"crud.d.ts","sourceRoot":"","sources":["../../../../src/api/routes/integrations/crud.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAcjC,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAGvD;;;;;;;;;;;GAWG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,eAAe,GAAG,IAAI,CAuJzE"}