@assemblyline-agents/node 5.0.10 → 6.0.0

package/dist/index.js

@@ -1,31 +1,29 @@
 import { createServer } from "node:http";
 import { resolve } from "node:path";
-import { adapter, ConnectionEventError } from "@assemblyline-agents/core";
-import { AssemblyLineRuntime, RunReplayError, RunCapacityError, durableAgentScopeForManifest, loadRuntimeBundle, queryAgentRuns, retryAfterSeconds, validateEvalRunOptions } from "@assemblyline-agents/runtime";
-import { deleteMemoryAdmin, listMemoryAdmin, parseMemoryAdminRoute, readMemoryAdmin } from "./memory-admin-http.js";
-import { createBlobAdapter, createConnectionStores, createMediaProcessors, createModelCredentialStore, createSandboxAdapter, createSelfImprovementStores, createStateAdapter, loadRunTimeline, loadRunTimelinePage } from "./adapters.js";
-import { apiRunCreationEnabled, evalRunsEnabled, authorizeOrSend, logHttpRequest, numberBodyValue, numberQueryValue, rateLimitOrSend, stringBodyValue, validateRuntimeHttpSecurity } from "./auth.js";
-import { HttpRequestError, firstHeaderValue, maxRequestBodyBytes, normalizeHeaders, readBody, send, summarizeRun } from "./http-io.js";
-import { serveRunEventStream, serveStreamingRun } from "./run-stream-http.js";
+import { adapter } from "@assemblyline-agents/core";
+import { AssemblyLineRuntime, loadRuntimeBundle, } from "@assemblyline-agents/runtime";
+import { createBlobAdapter, createConnectionStores, createMediaProcessors, createModelCredentialStore, createSandboxAdapter, createSelfImprovementStores, createStateAdapter, } from "./adapters.js";
+import { logHttpRequest, validateRuntimeHttpSecurity } from "./auth.js";
+import { HttpRequestError, send } from "./http-io.js";
 import { createCredentialBoundary, resolveGatewayCredentials, resolveGatewayEnvironment } from "./secrets.js";
-import { startRunReplay } from "./run-replay-http.js";
-import { matchRoute, parseAgentControlRoute, parseRunFeedbackRoute, parseRunReplayRoute, parseRunResumeRoute, parseRunRoute, parseSelfImprovementRoute } from "./route-match.js";
 import { resolveIngressRateLimit } from "./rate-limit.js";
-import { createNodeRuntimeHandle, installSignalHandlers } from "./lifecycle.js";
-import { DIRECT_CHANNEL, conversationBelongsToAgent, decodeConversationCursor, decodeMessageCursor, directAgentScope, directConversationPatch, directTurnFromBody, encodeConversationCursor, encodeMessageCursor, parseConversationHttpRoute } from "./direct-conversations-http.js";
-import { usageHttpResult, usageReconciliationHttpResult } from "./usage-http.js";
-import { isWorkspaceAdminPath, workspaceAdminHttpResult } from "./workspace-admin-http.js";
-export { resolveProvider } from "./provider-resolver.js";
+import { createNodeRuntimeHandle, installSignalHandlers, } from "./lifecycle.js";
+import { handleAdminHttpRoutes } from "./admin-http-routes.js";
+import { handleCoreHttpRoutes } from "./core-http-routes.js";
+import { handleConversationHttpRoutes } from "./conversation-http-routes.js";
+import { handleIngressHttpRoutes } from "./ingress-http-routes.js";
+import { handleRunHttpRoutes } from "./run-http-routes.js";
+export { resolveProvider, } from "./provider-resolver.js";
+export { createCredentialBoundary, resolveCredentialInventory, resolveGatewayCredentials, resolveGatewayEnvironment, } from "./secrets.js";
 export { createModelCredentialStore } from "./adapters.js";
+export { createMemoryRateLimiterStore, parseRateLimitSpec, resolveIngressRateLimit, } from "./rate-limit.js";
+export { createNodeRuntimeHandle, installSignalHandlers, } from "./lifecycle.js";
 export { runModelProviderAuth } from "./model-auth.js";
-export { createCredentialBoundary, resolveCredentialInventory, resolveGatewayCredentials, resolveGatewayEnvironment } from "./secrets.js";
-export { createMemoryRateLimiterStore, parseRateLimitSpec, resolveIngressRateLimit } from "./rate-limit.js";
-export { createNodeRuntimeHandle, installSignalHandlers } from "./lifecycle.js";
 export function nodeAdapter(options = {}) {
     return {
         ...adapter("node", options),
         kind: "node",
-        capabilities: ["http-runtime", "hosted-container-runtime", "local-server"]
+        capabilities: ["http-runtime", "hosted-container-runtime", "local-server"],
     };
 }
 export async function createProductionRuntimeOptions(options) {
@@ -36,7 +34,7 @@ export async function createProductionRuntimeOptions(options) {
         manifest: runtimeOptions.manifest,
         env: options.env ?? process.env,
         artifactRoot,
-        devMode: options.devMode ?? false
+        devMode: options.devMode ?? false,
     });
     const gatewayEnv = await resolveGatewayEnvironment(boundary, runtimeOptions.manifest);
     const gatewayCredentials = await resolveGatewayCredentials(boundary, runtimeOptions.manifest);
@@ -64,13 +62,15 @@ export async function createProductionRuntimeOptions(options) {
         credentialStore: boundary.store,
         gatewayCredentials,
         env: gatewayEnv,
-        devMode: options.devMode ?? false
+        devMode: options.devMode ?? false,
     };
-    const callbackBaseUrl = boundary.config.ASSEMBLY_LINE_CONNECTION_CALLBACK_BASE_URL ?? boundary.config.ASSEMBLY_LINE_PUBLIC_URL;
+    const callbackBaseUrl = boundary.config.ASSEMBLY_LINE_CONNECTION_CALLBACK_BASE_URL ??
+        boundary.config.ASSEMBLY_LINE_PUBLIC_URL;
     if (callbackBaseUrl)
         out.connectionCallbackBaseUrl = callbackBaseUrl;
     // Production default: bound run concurrency unless the operator chose a limit.
-    if (!(options.devMode ?? false) && boundary.config.ASSEMBLY_LINE_MAX_CONCURRENT_RUNS === undefined) {
+    if (!(options.devMode ?? false) &&
+        boundary.config.ASSEMBLY_LINE_MAX_CONCURRENT_RUNS === undefined) {
         out.maxConcurrentRuns = 16;
     }
     return out;
@@ -95,854 +95,20 @@ function createNodeRuntimeServerForRuntime(runtime, options, drain = { draining:
                 return;
             }
             const url = new URL(request.url, "http://localhost");
-            if (request.method === "GET" && url.pathname === "/health") {
-                if (!await authorizeOrSend(request, response, runtime, options, "public-health", url.pathname))
-                    return;
-                send(response, 200, revisionHealth(options.manifest));
-                return;
-            }
-            if (request.method === "GET" && url.pathname === "/healthz") {
-                if (!await authorizeOrSend(request, response, runtime, options, "public-health", url.pathname))
-                    return;
-                send(response, 200, {
-                    ok: true,
-                    agentRevision: options.manifest.agentRevision,
-                    buildRevision: options.manifest.buildRevision ?? options.manifest.agentRevision,
-                    capabilities: evalRunsEnabled(runtime, options) ? ["eval-runs"] : []
-                });
-                return;
-            }
-            if (request.method === "GET" && url.pathname === "/readyz") {
-                // Readiness (vs /health liveness): 503 while draining so load
-                // balancers stop routing new traffic during graceful shutdown.
-                if (!await authorizeOrSend(request, response, runtime, options, "public-health", url.pathname))
-                    return;
-                if (drain.draining) {
-                    send(response, 503, { ...revisionHealth(options.manifest), ok: false, draining: true });
-                    return;
-                }
-                send(response, 200, revisionHealth(options.manifest));
-                return;
-            }
-            if (request.method === "GET" && url.pathname === "/manifest") {
-                if (!await authorizeOrSend(request, response, runtime, options, "admin-read", url.pathname))
-                    return;
-                send(response, 200, options.manifest);
-                return;
-            }
-            if (request.method === "GET" && url.pathname === "/routes") {
-                if (!await authorizeOrSend(request, response, runtime, options, "admin-read", url.pathname))
-                    return;
-                send(response, 200, options.manifest.routeTable);
-                return;
-            }
-            const agentControlRoute = parseAgentControlRoute(url.pathname);
-            if (agentControlRoute && request.method === "GET" && agentControlRoute.kind === "control") {
-                if (!await authorizeOrSend(request, response, runtime, options, "agent-control", url.pathname))
-                    return;
-                send(response, 200, await runtime.getAgentControl());
-                return;
-            }
-            if (agentControlRoute && request.method === "POST" && agentControlRoute.kind !== "control") {
-                if (!await authorizeOrSend(request, response, runtime, options, "agent-control", url.pathname))
-                    return;
-                if (!await rateLimitOrSend(request, response, rateLimit, "agent-control", url.pathname))
-                    return;
-                const requestId = firstHeaderValue(request.headers["x-request-id"] ?? request.headers["x-railway-request-id"]);
-                const metadata = {
-                    source: "http",
-                    path: url.pathname,
-                    ...(requestId ? { requestId } : {})
-                };
-                const result = agentControlRoute.kind === "quiesce" || agentControlRoute.kind === "resume"
-                    ? await runtime.setAgentMaintenance(agentControlRoute.kind === "quiesce", metadata)
-                    : await runtime.setAgentEnabled(agentControlRoute.kind === "enable", metadata);
-                send(response, 200, result);
-                return;
-            }
-            if (isWorkspaceAdminPath(url.pathname)) {
-                const method = request.method ?? "GET";
-                if (!["GET", "POST", "DELETE"].includes(method)) {
-                    send(response, 405, { error: "Method not allowed." });
-                    return;
-                }
-                if (!await authorizeOrSend(request, response, runtime, options, method === "GET" ? "admin-read" : "agent-control", url.pathname))
-                    return;
-                try {
-                    const body = method === "POST"
-                        ? (await readBody(request, maxRequestBodyBytes(runtime, options))).body
-                        : {};
-                    send(response, 200, await workspaceAdminHttpResult(runtime, method, url.pathname, body, url.searchParams));
-                }
-                catch (error) {
-                    send(response, 400, { error: error instanceof Error ? error.message : String(error) });
-                }
-                return;
-            }
-            const conversationRoute = parseConversationHttpRoute(url.pathname);
-            if (conversationRoute?.kind === "collection" && request.method === "GET") {
-                if (!await authorizeOrSend(request, response, runtime, options, "admin-read", url.pathname))
-                    return;
-                if (!runtime.state.listConversations) {
-                    send(response, 501, { error: "The configured state adapter does not support conversation listing." });
-                    return;
-                }
-                const cursorValue = url.searchParams.get("cursor");
-                const before = decodeConversationCursor(cursorValue);
-                if (cursorValue && !before) {
-                    send(response, 400, { error: "Invalid conversation cursor." });
-                    return;
-                }
-                const limitParam = Number(url.searchParams.get("limit"));
-                const limit = Number.isFinite(limitParam) && limitParam > 0 ? Math.min(Math.floor(limitParam), 100) : 40;
-                const archivedValue = url.searchParams.get("archived");
-                const archived = archivedValue === "true" ? true : archivedValue === "all" ? undefined : false;
-                const listed = await runtime.state.listConversations({
-                    agentScope: directAgentScope(options.manifest),
-                    channel: url.searchParams.get("channel") || DIRECT_CHANNEL,
-                    ...(url.searchParams.get("subject") ? { subject: url.searchParams.get("subject") } : {}),
-                    ...(archived !== undefined ? { archived } : {}),
-                    ...(before ? { before } : {}),
-                    limit: limit + 1
-                });
-                const hasMore = listed.length > limit;
-                const conversations = listed.slice(0, limit);
-                send(response, 200, {
-                    conversations,
-                    nextCursor: hasMore && conversations.length > 0
-                        ? encodeConversationCursor(conversations[conversations.length - 1])
-                        : null
-                });
-                return;
-            }
-            if (conversationRoute?.kind === "messages" && request.method === "GET") {
-                if (!await authorizeOrSend(request, response, runtime, options, "admin-read", url.pathname))
-                    return;
-                const conversation = await runtime.state.getConversation(conversationRoute.conversationId);
-                if (!conversation || !conversationBelongsToAgent(conversation, directAgentScope(options.manifest))) {
-                    send(response, 404, { error: "Conversation not found." });
-                    return;
-                }
-                const cursorValue = url.searchParams.get("before");
-                const before = decodeMessageCursor(cursorValue);
-                if (cursorValue && !before) {
-                    send(response, 400, { error: "Invalid message cursor." });
-                    return;
-                }
-                const limitParam = Number(url.searchParams.get("limit"));
-                const limit = Number.isFinite(limitParam) && limitParam > 0 ? Math.min(Math.floor(limitParam), 100) : 50;
-                const listed = runtime.state.listMessages
-                    ? await runtime.state.listMessages({
-                        conversationId: conversation.id,
-                        ...(before ? { before } : {}),
-                        limit: limit + 1
-                    })
-                    : before
-                        ? []
-                        : await runtime.state.listRecentMessages(conversation.id, limit + 1);
-                if (before && !runtime.state.listMessages) {
-                    send(response, 501, { error: "The configured state adapter does not support message pagination." });
-                    return;
-                }
-                const hasMore = listed.length > limit;
-                const messages = hasMore ? listed.slice(1) : listed;
-                send(response, 200, {
-                    messages,
-                    nextCursor: hasMore && messages.length > 0 ? encodeMessageCursor(messages[0]) : null
-                });
-                return;
-            }
-            if (conversationRoute?.kind === "record" && request.method === "PATCH") {
-                if (!await authorizeOrSend(request, response, runtime, options, "agent-control", url.pathname))
-                    return;
-                if (!runtime.state.updateConversation) {
-                    send(response, 501, { error: "The configured state adapter does not support conversation updates." });
-                    return;
-                }
-                const existing = await runtime.state.getConversation(conversationRoute.conversationId);
-                if (!existing || !conversationBelongsToAgent(existing, directAgentScope(options.manifest))) {
-                    send(response, 404, { error: "Conversation not found." });
-                    return;
-                }
-                const { body } = await readBody(request, maxRequestBodyBytes(runtime, options));
-                const patch = directConversationPatch(body);
-                if (Object.keys(patch).length === 0) {
-                    send(response, 400, { error: "Provide a title, archived flag, or metadata patch." });
-                    return;
-                }
-                send(response, 200, await runtime.state.updateConversation(existing.id, patch));
-                return;
-            }
-            if (conversationRoute?.kind === "turns" && request.method === "POST") {
-                channel = DIRECT_CHANNEL;
-                if (!apiRunCreationEnabled(runtime, options)) {
-                    send(response, 403, { error: "API run creation is disabled." });
-                    return;
-                }
-                if (!await authorizeOrSend(request, response, runtime, options, "run-create", url.pathname))
-                    return;
-                if (!await rateLimitOrSend(request, response, rateLimit, "run-create", url.pathname, DIRECT_CHANNEL))
-                    return;
-                const existing = await runtime.state.getConversation(conversationRoute.conversationId);
-                if (existing && !conversationBelongsToAgent(existing, directAgentScope(options.manifest))) {
-                    send(response, 404, { error: "Conversation not found." });
-                    return;
-                }
-                if (existing?.channel && existing.channel !== DIRECT_CHANNEL) {
-                    send(response, 409, { error: `Conversation belongs to channel ${existing.channel}.` });
-                    return;
-                }
-                if (existing?.archivedAt) {
-                    send(response, 409, { error: "Archived conversations cannot accept new turns." });
-                    return;
-                }
-                const { body } = await readBody(request, maxRequestBodyBytes(runtime, options));
-                const idempotencyKey = firstHeaderValue(request.headers["idempotency-key"]);
-                const direct = directTurnFromBody({
-                    conversationId: conversationRoute.conversationId,
-                    body,
-                    ...(idempotencyKey ? { idempotencyKey } : {})
-                });
-                if (!direct.turn.message && !(direct.turn.attachments?.length)) {
-                    send(response, 400, { error: "A message or attachment is required." });
-                    return;
-                }
-                const workspaceId = stringBodyValue(body.workspaceId);
-                const projectId = stringBodyValue(body.projectId);
-                const tenantId = stringBodyValue(body.tenantId);
-                const runOptions = {
-                    message: direct.turn.message,
-                    channel: DIRECT_CHANNEL,
-                    approve: direct.approve,
-                    turn: direct.turn,
-                    ...(workspaceId ? { workspaceId } : {}),
-                    ...(projectId ? { projectId } : {}),
-                    ...(tenantId ? { tenantId } : {})
-                };
-                if (body.sandboxCredentials && typeof body.sandboxCredentials === "object" && !Array.isArray(body.sandboxCredentials)) {
-                    Object.assign(runOptions, { sandboxCredentials: body.sandboxCredentials });
-                }
-                try {
-                    if (direct.stream) {
-                        await serveStreamingRun(runtime, response, (onRunCreated) => runtime.run({ ...runOptions, onRunCreated }), (result) => summarizeRun(result));
-                        return;
-                    }
-                    const result = await runtime.run(runOptions);
-                    send(response, 200, summarizeRun(result));
-                }
-                catch (error) {
-                    if (error instanceof RunCapacityError) {
-                        send(response, 429, { error: "Run capacity exhausted. Retry later.", retryAfterMs: error.retryAfterMs }, {
-                            "retry-after": String(retryAfterSeconds(error.retryAfterMs))
-                        });
-                        return;
-                    }
-                    throw error;
-                }
-                return;
-            }
-            if (request.method === "GET" && url.pathname === "/runs") {
-                if (!await authorizeOrSend(request, response, runtime, options, "admin-read", url.pathname))
-                    return;
-                // Light list: no per-run detail (avoids the 1+4N fan-out that hangs on
-                // busy agents). Bounded to the most recent runs; ?limit overrides.
-                const limitParam = Number(url.searchParams.get("limit"));
-                const limit = Number.isFinite(limitParam) && limitParam > 0 ? Math.min(limitParam, 1000) : 200;
-                send(response, 200, await queryAgentRuns(runtime.state, options.manifest, { includeDetails: false, limit }));
-                return;
-            }
-            const memoryAdminRoute = parseMemoryAdminRoute(url.pathname);
-            if (memoryAdminRoute) {
-                const agentScope = durableAgentScopeForManifest(options.manifest);
-                if (request.method === "GET") {
-                    if (!await authorizeOrSend(request, response, runtime, options, "admin-read", url.pathname))
-                        return;
-                    const result = memoryAdminRoute.kind === "list"
-                        ? await listMemoryAdmin(runtime.state, agentScope, url.searchParams)
-                        : await readMemoryAdmin(runtime.state, agentScope, memoryAdminRoute.path);
-                    send(response, result.status, result.body);
-                    return;
-                }
-                if (request.method === "DELETE" && memoryAdminRoute.kind === "document") {
-                    if (!await authorizeOrSend(request, response, runtime, options, "agent-control", url.pathname))
-                        return;
-                    if (!await rateLimitOrSend(request, response, rateLimit, "agent-control", url.pathname))
-                        return;
-                    const result = await deleteMemoryAdmin(runtime.state, agentScope, memoryAdminRoute.path, url.searchParams);
-                    send(response, result.status, result.body);
-                    return;
-                }
-                send(response, 405, { error: "Method not allowed." });
-                return;
-            }
-            const selfImprovementRoute = parseSelfImprovementRoute(url.pathname);
-            const selfImprovementSurface = url.searchParams.get("surface")?.trim() || "root";
-            if (selfImprovementRoute && request.method === "GET") {
-                if (!await authorizeOrSend(request, response, runtime, options, "admin-read", url.pathname))
-                    return;
-                if (selfImprovementRoute.kind === "pending") {
-                    send(response, 200, { surface: selfImprovementSurface, changes: await runtime.listPendingSkillChanges(selfImprovementSurface) });
-                    return;
-                }
-                if (selfImprovementRoute.kind === "reviews") {
-                    send(response, 200, { surface: selfImprovementSurface, reviews: await runtime.listBackgroundReviews(selfImprovementSurface) });
-                    return;
-                }
-                if (selfImprovementRoute.kind === "revisions") {
-                    send(response, 200, { surface: selfImprovementSurface, name: selfImprovementRoute.name, revisions: await runtime.listSkillRevisions(selfImprovementRoute.name, selfImprovementSurface) });
-                    return;
-                }
-                send(response, 405, { error: "Method not allowed." });
-                return;
-            }
-            if (selfImprovementRoute && request.method === "POST") {
-                if (!await authorizeOrSend(request, response, runtime, options, "agent-control", url.pathname))
-                    return;
-                if (!await rateLimitOrSend(request, response, rateLimit, "agent-control", url.pathname))
-                    return;
-                if (selfImprovementRoute.kind === "approve") {
-                    try {
-                        send(response, 200, await runtime.approveSkillChange(selfImprovementRoute.id, selfImprovementSurface));
-                    }
-                    catch (error) {
-                        if (error instanceof Error && /not found/i.test(error.message)) {
-                            send(response, 404, { error: error.message });
-                            return;
-                        }
-                        throw error;
-                    }
-                    return;
-                }
-                if (selfImprovementRoute.kind === "reject") {
-                    try {
-                        await runtime.rejectSkillChange(selfImprovementRoute.id, selfImprovementSurface);
-                        send(response, 200, { rejected: true, id: selfImprovementRoute.id, surface: selfImprovementSurface });
-                    }
-                    catch (error) {
-                        if (error instanceof Error && /not found/i.test(error.message)) {
-                            send(response, 404, { error: error.message });
-                            return;
-                        }
-                        throw error;
-                    }
-                    return;
-                }
-                if (selfImprovementRoute.kind === "restore") {
-                    const { body } = await readBody(request, maxRequestBodyBytes(runtime, options));
-                    const revision = numberBodyValue(body.revision);
-                    if (revision === undefined || revision < 1 || !Number.isInteger(revision)) {
-                        send(response, 400, { error: "A positive integer revision is required." });
-                        return;
-                    }
-                    try {
-                        send(response, 200, await runtime.restoreSkillRevision(selfImprovementRoute.name, revision, selfImprovementSurface));
-                    }
-                    catch (error) {
-                        if (error instanceof Error && /not found/i.test(error.message)) {
-                            send(response, 404, { error: error.message });
-                            return;
-                        }
-                        throw error;
-                    }
-                    return;
-                }
-                send(response, 405, { error: "Method not allowed." });
-                return;
-            }
-            if (request.method === "GET" && url.pathname === "/usage") {
-                if (!await authorizeOrSend(request, response, runtime, options, "admin-read", url.pathname))
-                    return;
-                try {
-                    send(response, 200, await usageHttpResult(runtime.state, url));
-                }
-                catch (error) {
-                    send(response, 400, { error: error instanceof Error ? error.message : String(error) });
-                }
-                return;
-            }
-            if (request.method === "POST" && url.pathname === "/usage/reconcile") {
-                if (!await authorizeOrSend(request, response, runtime, options, "agent-control", url.pathname))
-                    return;
-                try {
-                    const { body } = await readBody(request, maxRequestBodyBytes(runtime, options));
-                    send(response, 200, await usageReconciliationHttpResult(runtime.state, runtime.env, body));
-                }
-                catch (error) {
-                    send(response, 400, { error: error instanceof Error ? error.message : String(error) });
-                }
-                return;
-            }
-            if ((request.method === "GET" || request.method === "POST")
-                && url.pathname === "/assembly-line/automations/tick") {
-                if (!await authorizeOrSend(request, response, runtime, options, "scheduler", url.pathname))
-                    return;
-                if (!await rateLimitOrSend(request, response, rateLimit, "scheduler", url.pathname))
-                    return;
-                const body = request.method === "POST" ? (await readBody(request, maxRequestBodyBytes(runtime, options))).body : {};
-                const nowValue = stringBodyValue(body.now) ?? url.searchParams.get("now") ?? undefined;
-                const lookbackValue = numberBodyValue(body.lookbackMs) ?? numberQueryValue(url.searchParams.get("lookbackMs"));
-                const tickOptions = {};
-                if (nowValue)
-                    tickOptions.now = new Date(nowValue);
-                if (lookbackValue !== undefined)
-                    tickOptions.lookbackMs = lookbackValue;
-                if (tickOptions.now && Number.isNaN(tickOptions.now.getTime())) {
-                    send(response, 400, { error: "Invalid scheduler now timestamp." });
-                    return;
-                }
-                const results = await runtime.runDueAutomations(tickOptions);
-                send(response, 200, { ok: true, results });
-                return;
-            }
-            if (request.method === "POST" && url.pathname === "/assembly-line/automations/events") {
-                if (!await authorizeOrSend(request, response, runtime, options, "agent-control", url.pathname))
-                    return;
-                if (!await rateLimitOrSend(request, response, rateLimit, "run-create", url.pathname))
-                    return;
-                const { body } = await readBody(request, maxRequestBodyBytes(runtime, options));
-                const source = stringBodyValue(body.source);
-                const event = stringBodyValue(body.event);
-                const eventId = stringBodyValue(body.eventId);
-                const payload = body.payload;
-                if (!source || !event || !eventId || !payload || typeof payload !== "object" || Array.isArray(payload)) {
-                    send(response, 400, { error: "Automation events require source, event, eventId, and an object payload." });
-                    return;
-                }
-                const automationEvent = {
-                    source,
-                    event,
-                    eventId,
-                    payload: payload
-                };
-                const occurredAt = stringBodyValue(body.occurredAt);
-                const userId = stringBodyValue(body.userId);
-                const conversationId = stringBodyValue(body.conversationId);
-                const projectId = stringBodyValue(body.projectId);
-                if (occurredAt && Number.isNaN(new Date(occurredAt).getTime())) {
-                    send(response, 400, { error: "Automation event occurredAt must be a valid ISO timestamp." });
-                    return;
-                }
-                if (occurredAt)
-                    automationEvent.occurredAt = occurredAt;
-                if (userId)
-                    automationEvent.userId = userId;
-                if (conversationId)
-                    automationEvent.conversationId = conversationId;
-                if (projectId)
-                    automationEvent.projectId = projectId;
-                if (body.delivery && typeof body.delivery === "object" && !Array.isArray(body.delivery)) {
-                    automationEvent.delivery = body.delivery;
-                }
-                if (body.metadata && typeof body.metadata === "object" && !Array.isArray(body.metadata)) {
-                    automationEvent.metadata = body.metadata;
-                }
-                const results = await runtime.dispatchAutomationEvent(automationEvent);
-                send(response, 200, { ok: true, matched: results.length, results });
-                return;
-            }
-            if (request.method === "POST" && url.pathname === "/assembly-line/connections/events/reconcile") {
-                if (!await authorizeOrSend(request, response, runtime, options, "agent-control", url.pathname))
-                    return;
-                const { body } = await readBody(request, maxRequestBodyBytes(runtime, options));
-                const principal = stringBodyValue(body.userId) && stringBodyValue(body.issuer)
-                    ? { type: "user", id: stringBodyValue(body.userId), issuer: stringBodyValue(body.issuer) }
-                    : undefined;
-                const connection = stringBodyValue(body.connection);
-                const publicUrl = stringBodyValue(body.publicUrl);
-                const results = await runtime.reconcileConnectionEvents({
-                    ...(connection ? { connection } : {}),
-                    ...(publicUrl ? { publicUrl } : {}),
-                    ...(principal ? { principal } : {}),
-                    force: body.force === true
-                });
-                send(response, 200, { ok: true, results });
-                return;
-            }
-            if (request.method === "GET" && url.pathname === "/assembly-line/connections/events") {
-                if (!await authorizeOrSend(request, response, runtime, options, "admin-read", url.pathname))
-                    return;
-                const results = await runtime.checkConnectionEvents(url.searchParams.get("connection") ?? undefined);
-                send(response, 200, { ok: true, results });
-                return;
-            }
-            if (request.method === "GET" && url.pathname.startsWith("/runs/")) {
-                if (!await authorizeOrSend(request, response, runtime, options, "admin-read", url.pathname))
-                    return;
-                const runRoute = parseRunRoute(url.pathname);
-                if (!runRoute) {
-                    send(response, 404, { error: "Not found." });
-                    return;
-                }
-                if (runRoute.kind === "stream") {
-                    if (!await runtime.state.getRun(runRoute.runId)) {
-                        send(response, 404, { error: `Run not found: ${runRoute.runId}` });
-                        return;
-                    }
-                    const lastEventId = firstHeaderValue(request.headers["last-event-id"]) ?? url.searchParams.get("lastEventId") ?? undefined;
-                    await serveRunEventStream(runtime, response, runRoute.runId, lastEventId);
-                    return;
-                }
-                const paginatedTimeline = runRoute.kind === "timeline" && url.searchParams.has("limit");
-                const before = numberQueryValue(url.searchParams.get("before"));
-                const after = numberQueryValue(url.searchParams.get("after"));
-                const limit = numberQueryValue(url.searchParams.get("limit"));
-                if (paginatedTimeline && limit === undefined) {
-                    send(response, 400, { error: "Run timeline limit must be a number." });
-                    return;
-                }
-                let timeline;
-                try {
-                    timeline = paginatedTimeline
-                        ? await loadRunTimelinePage(runtime, runRoute.runId, {
-                            ...(before !== undefined ? { before } : {}),
-                            ...(after !== undefined ? { after } : {}),
-                            limit: limit
-                        })
-                        : await loadRunTimeline(runtime, runRoute.runId);
-                }
-                catch (error) {
-                    if (!paginatedTimeline)
-                        throw error;
-                    send(response, 400, { error: error instanceof Error ? error.message : String(error) });
-                    return;
-                }
-                if (!timeline) {
-                    send(response, 404, { error: `Run not found: ${runRoute.runId}` });
-                    return;
-                }
-                if (runRoute.kind === "events") {
-                    send(response, 200, { runId: runRoute.runId, events: timeline.events });
-                    return;
-                }
-                if (runRoute.kind === "timeline") {
-                    send(response, 200, timeline);
-                    return;
-                }
-                send(response, 200, timeline);
-                return;
-            }
-            if (request.method === "POST" && url.pathname.startsWith("/runs/")) {
-                const replayRoute = parseRunReplayRoute(url.pathname);
-                if (replayRoute) {
-                    if (!await authorizeOrSend(request, response, runtime, options, "agent-control", url.pathname))
-                        return;
-                    if (!await rateLimitOrSend(request, response, rateLimit, "run-create", url.pathname))
-                        return;
-                    try {
-                        const replay = await startRunReplay(runtime, replayRoute.runId);
-                        void replay.completion.catch((error) => {
-                            runtime.logger.error("replay run failed after durable creation", {
-                                sourceRunId: replayRoute.runId,
-                                runId: replay.run.id,
-                                error: error instanceof Error ? error.message : String(error)
-                            });
-                        });
-                        send(response, 202, { runId: replay.run.id, status: replay.run.status });
-                    }
-                    catch (error) {
-                        if (error instanceof RunReplayError) {
-                            send(response, error.code === "run_not_found" ? 404 : 409, { error: error.message, code: error.code });
-                            return;
-                        }
-                        if (error instanceof RunCapacityError) {
-                            send(response, 429, { error: "Run capacity exhausted. Retry later.", retryAfterMs: error.retryAfterMs }, {
-                                "retry-after": String(retryAfterSeconds(error.retryAfterMs))
-                            });
-                            return;
-                        }
-                        throw error;
-                    }
-                    return;
-                }
-                const feedbackRoute = parseRunFeedbackRoute(url.pathname);
-                if (feedbackRoute) {
-                    if (!await authorizeOrSend(request, response, runtime, options, "run-control", url.pathname))
-                        return;
-                    if (!await rateLimitOrSend(request, response, rateLimit, "run-control", url.pathname))
-                        return;
-                    if (!await runtime.state.getRun(feedbackRoute.runId)) {
-                        send(response, 404, { error: `Run not found: ${feedbackRoute.runId}` });
-                        return;
-                    }
-                    const { body } = await readBody(request, maxRequestBodyBytes(runtime, options));
-                    const rating = stringBodyValue(body.rating);
-                    const comment = stringBodyValue(body.comment);
-                    if (rating !== "positive" && rating !== "negative") {
-                        send(response, 400, { error: "Feedback rating must be 'positive' or 'negative'." });
-                        return;
-                    }
-                    const result = await runtime.recordRunFeedback(feedbackRoute.runId, {
-                        rating,
-                        ...(comment ? { comment } : {})
-                    });
-                    send(response, 202, result);
-                    return;
-                }
-                const resumeRoute = parseRunResumeRoute(url.pathname);
-                if (resumeRoute) {
-                    const isHitlResume = resumeRoute.kind === "approve" || resumeRoute.kind === "answer";
-                    const routeClass = isHitlResume || resumeRoute.kind === "resume" ? "run-resume" : "run-control";
-                    if (!await authorizeOrSend(request, response, runtime, options, routeClass, url.pathname))
-                        return;
-                    if (!await rateLimitOrSend(request, response, rateLimit, routeClass, url.pathname))
-                        return;
-                    const run = await runtime.state.getRun(resumeRoute.runId);
-                    if (!run) {
-                        send(response, 404, { error: `Run not found: ${resumeRoute.runId}` });
-                        return;
-                    }
-                    const expected = resumeRoute.kind === "approve"
-                        ? "waiting_for_approval"
-                        : resumeRoute.kind === "answer"
-                            ? "waiting_for_input"
-                            : resumeRoute.kind === "suspend"
-                                ? "running"
-                                : resumeRoute.kind === "resume"
-                                    ? "suspended"
-                                    : undefined;
-                    if (expected && run.status !== expected) {
-                        send(response, 409, { error: `Run ${resumeRoute.runId} is not ${expected} (status: ${run.status}).` });
-                        return;
-                    }
-                    if (resumeRoute.kind === "cancel" && run.status === "cancelled") {
-                        // Cancellation is an idempotent operator command. A retry may be
-                        // the first response the client receives even when an earlier
-                        // request already committed the terminal state.
-                        send(response, 200, {
-                            runId: run.id,
-                            status: run.status,
-                            controlIntent: run.controlIntent ?? null
-                        });
-                        return;
-                    }
-                    if (resumeRoute.kind === "cancel" && ["completed", "failed"].includes(run.status)) {
-                        send(response, 409, { error: `Run ${resumeRoute.runId} is already terminal (status: ${run.status}).` });
-                        return;
-                    }
-                    let answer = "";
-                    if (resumeRoute.kind === "answer") {
-                        const { body } = await readBody(request, maxRequestBodyBytes(runtime, options));
-                        answer = typeof body.answer === "string" ? body.answer : "";
-                        if (!answer) {
-                            send(response, 400, { error: "An 'answer' string is required to resume a waiting run." });
-                            return;
-                        }
-                    }
-                    try {
-                        if (resumeRoute.kind === "cancel" || resumeRoute.kind === "suspend") {
-                            const controlled = resumeRoute.kind === "cancel"
-                                ? await runtime.cancelRun(resumeRoute.runId)
-                                : await runtime.suspendRun(resumeRoute.runId);
-                            send(response, controlled.status === "running" ? 202 : 200, {
-                                runId: controlled.id,
-                                status: controlled.status,
-                                controlIntent: controlled.controlIntent ?? null
-                            });
-                            return;
-                        }
-                        const result = resumeRoute.kind === "approve"
-                            ? await runtime.resumeApproval(resumeRoute.runId)
-                            : resumeRoute.kind === "answer"
-                                ? await runtime.resumeInput(resumeRoute.runId, answer)
-                                : await runtime.resumeSuspended(resumeRoute.runId);
-                        send(response, 200, summarizeRun(result));
-                    }
-                    catch (error) {
-                        if (error instanceof RunCapacityError) {
-                            send(response, 429, { error: "Run capacity exhausted. Retry later.", retryAfterMs: error.retryAfterMs }, {
-                                "retry-after": String(retryAfterSeconds(error.retryAfterMs))
-                            });
-                            return;
-                        }
-                        // The resume idempotency claim rejects a concurrent/replayed resume.
-                        const message = error instanceof Error ? error.message : String(error);
-                        if (resumeRoute.kind === "cancel" && /already terminal/i.test(message)) {
-                            const latest = await runtime.state.getRun(resumeRoute.runId);
-                            if (latest?.status === "cancelled") {
-                                send(response, 200, {
-                                    runId: latest.id,
-                                    status: latest.status,
-                                    controlIntent: latest.controlIntent ?? null
-                                });
-                                return;
-                            }
-                        }
-                        if (/already in progress|not waiting|not suspended|not running|already terminal/i.test(message)) {
-                            send(response, 409, { error: message });
-                            return;
-                        }
-                        throw error;
-                    }
-                    return;
-                }
-                // Fall through: unknown POST /runs/... path.
-            }
-            if (request.method === "GET" && url.pathname === "/assembly-line/connections/authorize") {
-                // Authenticated JSON, not a public 302: the operator surface fetches
-                // the consent URL and opens the browser itself, so unauthenticated
-                // callers can neither trigger consent flows nor enumerate connection
-                // names. The provider's redirect lands on the public callback below.
-                if (!await authorizeOrSend(request, response, runtime, options, "agent-control", url.pathname))
-                    return;
-                if (!await rateLimitOrSend(request, response, rateLimit, "agent-control", url.pathname))
-                    return;
-                const connectionName = url.searchParams.get("connection") ?? "";
-                if (!connectionName) {
-                    send(response, 400, { error: "A 'connection' query parameter is required." });
-                    return;
-                }
-                const session = {};
-                const sessionChannel = url.searchParams.get("channel");
-                const sessionUserId = url.searchParams.get("userId");
-                const sessionIssuer = url.searchParams.get("issuer");
-                const sessionConversationId = url.searchParams.get("conversationId");
-                if (sessionChannel)
-                    session.channel = sessionChannel;
-                if (sessionUserId)
-                    session.userId = sessionUserId;
-                if (sessionUserId && sessionIssuer) {
-                    session.principal = { type: "user", id: sessionUserId, issuer: sessionIssuer };
-                }
-                if (sessionConversationId)
-                    session.conversationId = sessionConversationId;
-                const result = await runtime.beginConnectionAuthorization(connectionName, session);
-                send(response, result.status === "unavailable" ? 409 : 200, result);
-                return;
-            }
-            if ((request.method === "GET" || request.method === "POST") && url.pathname === "/assembly-line/connections/callback") {
-                if (!await authorizeOrSend(request, response, runtime, options, "connection-callback", url.pathname))
-                    return;
-                const { rawBody, body } = request.method === "POST" ? await readBody(request, maxRequestBodyBytes(runtime, options)) : { rawBody: "", body: {} };
-                const params = Object.fromEntries(url.searchParams.entries());
-                if (Object.keys(body).length > 0) {
-                    for (const [key, value] of Object.entries(body)) {
-                        if (typeof value === "string")
-                            params[key] = value;
-                    }
-                }
-                const callbackInput = {
-                    params,
-                    method: request.method
-                };
-                if (rawBody)
-                    callbackInput.body = rawBody;
-                const result = await runtime.completeConnectionAuthorizationCallback(callbackInput);
-                send(response, result.status, result.body);
-                return;
-            }
-            const connectionEvent = /^\/assembly-line\/connections\/([^/]+)\/events\/([^/]+)$/u.exec(url.pathname);
-            if ((request.method === "GET" || request.method === "POST") && connectionEvent?.[1] && connectionEvent[2]) {
-                if (!await authorizeOrSend(request, response, runtime, options, "connection-event", url.pathname))
-                    return;
-                if (!await rateLimitOrSend(request, response, rateLimit, "connection-event", url.pathname))
-                    return;
-                const rawBody = request.method === "POST"
-                    ? (await readBody(request, maxRequestBodyBytes(runtime, options))).rawBody
-                    : "";
-                try {
-                    const result = await runtime.acceptConnectionEvent(decodeURIComponent(connectionEvent[1]), decodeURIComponent(connectionEvent[2]), {
-                        method: request.method,
-                        headers: normalizeHeaders(request.headers),
-                        body: rawBody,
-                        query: Object.fromEntries(url.searchParams.entries())
-                    });
-                    send(response, result.status, result.body ?? { ok: true, accepted: result.accepted, duplicates: result.duplicates, ignored: result.ignored }, result.headers);
-                }
-                catch (error) {
-                    if (error instanceof ConnectionEventError) {
-                        send(response, error.status, { error: error.message });
-                        return;
-                    }
-                    throw error;
-                }
-                return;
-            }
-            if (request.method === "POST" && url.pathname === "/runs") {
-                if (!apiRunCreationEnabled(runtime, options)) {
-                    send(response, 403, { error: "API run creation is disabled." });
-                    return;
-                }
-                if (!await authorizeOrSend(request, response, runtime, options, "run-create", url.pathname))
-                    return;
-                if (!await rateLimitOrSend(request, response, rateLimit, "run-create", url.pathname))
-                    return;
-                const { body } = await readBody(request, maxRequestBodyBytes(runtime, options));
-                const runOptions = {
-                    message: typeof body.message === "string" ? body.message : "",
-                    approve: body.approve === true,
-                    channel: typeof body.channel === "string" ? body.channel : "http"
-                };
-                if (typeof body.toolName === "string")
-                    Object.assign(runOptions, { toolName: body.toolName });
-                if (body.input !== undefined)
-                    Object.assign(runOptions, { input: body.input });
-                if (typeof body.conversationId === "string")
-                    Object.assign(runOptions, { conversationId: body.conversationId });
-                if (typeof body.projectId === "string")
-                    Object.assign(runOptions, { projectId: body.projectId });
-                if (typeof body.workspaceId === "string")
-                    Object.assign(runOptions, { workspaceId: body.workspaceId });
-                if (typeof body.tenantId === "string")
-                    Object.assign(runOptions, { tenantId: body.tenantId });
-                if (typeof body.userId === "string")
-                    Object.assign(runOptions, { userId: body.userId });
-                if (body.sandboxCredentials && typeof body.sandboxCredentials === "object" && !Array.isArray(body.sandboxCredentials)) {
-                    Object.assign(runOptions, { sandboxCredentials: body.sandboxCredentials });
-                }
-                if (body.eval !== undefined) {
-                    if (!evalRunsEnabled(runtime, options)) {
-                        send(response, 403, { error: "Eval run options are disabled. Set ASSEMBLY_LINE_ENABLE_EVAL_RUNS=true or allowEvalRuns." });
-                        return;
-                    }
-                    try {
-                        Object.assign(runOptions, { eval: validateEvalRunOptions(body.eval) });
-                    }
-                    catch (error) {
-                        send(response, 400, { error: error instanceof Error ? error.message : String(error) });
-                        return;
-                    }
-                }
-                try {
-                    if (body.stream === true) {
-                        await serveStreamingRun(runtime, response, (onRunCreated) => runtime.run({ ...runOptions, onRunCreated }), (result) => summarizeRun(result));
-                        return;
-                    }
-                    const result = await runtime.run(runOptions);
-                    send(response, 200, summarizeRun(result));
-                }
-                catch (error) {
-                    if (error instanceof RunCapacityError) {
-                        send(response, 429, { error: "Run capacity exhausted. Retry later.", retryAfterMs: error.retryAfterMs }, {
-                            "retry-after": String(retryAfterSeconds(error.retryAfterMs))
-                        });
-                        return;
-                    }
-                    throw error;
-                }
-                return;
-            }
-            const requestMethod = request.method;
-            const routeMatch = requestMethod ? matchRoute(options.manifest.routeTable, requestMethod, url.pathname) : undefined;
-            if (routeMatch && requestMethod) {
-                channel = routeMatch.route.channel;
-                const authorization = await authorizeOrSend(request, response, runtime, options, "provider-channel", url.pathname, channel);
-                if (!authorization)
-                    return;
-                if (!await rateLimitOrSend(request, response, rateLimit, "provider-channel", url.pathname, channel))
-                    return;
-                const { rawBody, rawBodyBytes, body } = await readBody(request, maxRequestBodyBytes(runtime, options));
-                const result = await runtime.dispatchHttpChannel(routeMatch.route.channel, {
-                    method: requestMethod,
-                    url: request.url,
-                    path: url.pathname,
-                    params: routeMatch.params,
-                    headers: normalizeHeaders(request.headers),
-                    rawBody,
-                    rawBodyBytes,
-                    body,
-                    trusted: authorization.trusted === true
-                });
-                send(response, result.status, result.body, result.headers);
+            const routeContext = {
+                runtime,
+                options,
+                rateLimit,
+                drain,
+                setChannel(value) {
+                    channel = value;
+                },
+            };
+            if ((await handleCoreHttpRoutes(request, response, url, routeContext)) ||
+                (await handleConversationHttpRoutes(request, response, url, routeContext)) ||
+                (await handleAdminHttpRoutes(request, response, url, routeContext)) ||
+                (await handleRunHttpRoutes(request, response, url, routeContext)) ||
+                (await handleIngressHttpRoutes(request, response, url, routeContext))) {
                 return;
             }
             send(response, 404, { error: "Not found." });
@@ -957,7 +123,9 @@ function createNodeRuntimeServerForRuntime(runtime, options, drain = { draining:
             // to callers.
             runtime.logger.error("unhandled runtime http error", {
                 error: error instanceof Error ? error.message : String(error),
-                ...(error instanceof Error && error.stack ? { stack: error.stack } : {})
+                ...(error instanceof Error && error.stack
+                    ? { stack: error.stack }
+                    : {}),
             });
             send(response, 500, { error: "Internal server error." });
         }
@@ -982,11 +150,12 @@ export async function listenNodeRuntime(options) {
     if (scheduler)
         server.once("close", stopScheduler);
     const env = options.env ?? runtime.env ?? process.env;
-    if (env.ASSEMBLY_LINE_RUN_RECOVERY !== "false" && env.ASSEMBLY_LINE_RUN_RECOVERY !== "0") {
+    if (env.ASSEMBLY_LINE_RUN_RECOVERY !== "false" &&
+        env.ASSEMBLY_LINE_RUN_RECOVERY !== "0") {
         // Repair runs orphaned by a previous process before accepting new traffic.
         await runtime.recoverIncompleteRuns().catch((error) => {
             runtime.logger.warn("boot run recovery failed", {
-                error: error instanceof Error ? error.message : String(error)
+                error: error instanceof Error ? error.message : String(error),
             });
         });
     }
@@ -1007,14 +176,14 @@ export async function listenNodeRuntime(options) {
         env,
         stopIngress,
         stopScheduler,
-        stopWorkers
+        stopWorkers,
     };
     if (scheduler)
         handleInput.scheduler = scheduler;
     if (ingress)
         handleInput.ingress = ingress;
     const handle = createNodeRuntimeHandle(handleInput);
-    // Hosts like Railway send SIGTERM on every redeploy/restart. With no handler
+    // Hosted orchestrators send SIGTERM on redeploy/restart. With no handler
     // installed, Node terminates immediately and the graceful drain never runs, so
     // in-flight runs are orphaned. Install the handlers by default (opt-out via
     // option or ASSEMBLY_LINE_SIGNAL_HANDLERS) so redeploys drain instead of hard-kill.
@@ -1025,13 +194,6 @@ export async function listenNodeRuntime(options) {
     }
     return handle;
 }
-function revisionHealth(manifest) {
-    return {
-        ok: true,
-        agentRevision: manifest.agentRevision,
-        buildRevision: manifest.buildRevision ?? manifest.agentRevision
-    };
-}
 function once(fn) {
     let done = false;
     return () => {