@ashlr/hub 2.2.0

package/dist/core/types.js

@@ -0,0 +1,9 @@
+/**
+ * THE CONTRACT.
+ *
+ * Every type that crosses a module boundary in ashlr-hub lives here.
+ * Downstream agents (git, classify, index-engine, tidy, cli, raycast)
+ * import from this file and MUST NOT redefine these shapes.
+ */
+export {};
+//# sourceMappingURL=types.js.map

package/dist/core/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/core/types.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG"}

package/dist/core/web/api.d.ts

@@ -0,0 +1,53 @@
+/**
+ * core/web/api.ts — M14 JSON API handler.
+ *
+ * Handles all /api/* routes for the local web dashboard. Returns true if it
+ * handled the request (so server.ts does NOT fall through to static serving),
+ * false otherwise.
+ *
+ * Read-only routes (always available, no auth):
+ *   GET /api/snapshot          -> buildSnapshot(cfg)
+ *   GET /api/portfolio         -> buildSnapshot(cfg).portfolio | null (read-only; M29)
+ *   GET /api/runs              -> listRuns()
+ *   GET /api/run/:id           -> loadRun(id) | 404
+ *   GET /api/swarms            -> listSwarms()
+ *   GET /api/swarm/:id         -> loadSwarm(id) | 404
+ *   GET /api/pulse?window=7d   -> buildRollup(window, cfg)
+ *   GET /api/genome[?q=...]    -> recall(q, cfg) | loadGenome(cfg)
+ *   GET /api/inbox             -> listProposals({status:'pending'}) (read-only; M23)
+ *   GET /api/daemon            -> loadDaemonState() (read-only; M24; no control endpoint)
+ *   GET /api/events            -> Server-Sent Events stream
+ *
+ * Mutating route (ONLY when ctx.allowDispatch === true + token header):
+ *   POST /api/run              -> runGoal (budget-capped, local-first)
+ *
+ * SECURITY:
+ *  - Never throws (500 on internal error).
+ *  - Metadata only — no secret values ever serialised.
+ *  - No outward/SSRF calls.
+ *  - POST /api/run: 404 when !allowDispatch; constant-time token compare;
+ *    requires Content-Type: application/json (415 otherwise); budget clamped,
+ *    allowCloud:false always.
+ *  - SSE: bounded poll, capped concurrent connections, timers cleared on
+ *    client disconnect AND on server close() via the returned cleanup registry
+ *    (tracked by server.ts).
+ */
+import type { IncomingMessage, ServerResponse } from 'node:http';
+import type { AshlrConfig } from '../types.js';
+/**
+ * Drain all open SSE connections (called by server.ts close()).
+ * Each cleanup clears the interval and ends the response.
+ */
+export declare function drainSseConnections(): void;
+/**
+ * Handle a single request if its URL matches an /api/* route.
+ *
+ * @returns true if the request was an /api/* route and a response was written;
+ *          false otherwise (server.ts falls through to static serving).
+ *
+ * Never throws — all errors are caught and returned as JSON 500 responses.
+ */
+export declare function handleApi(req: IncomingMessage, res: ServerResponse, cfg: AshlrConfig, ctx: {
+    token: string;
+    allowDispatch: boolean;
+}): Promise<boolean>;