@cat-factory/contracts 0.319.0 → 0.322.0

package/dist/routes/public-kaizen.d.ts

@@ -0,0 +1,240 @@
+/**
+ * One page of the workspace's Kaizen entries, newest first, with the acknowledgement / status /
+ * agent-kind / since filters applied in SQL.
+ *
+ * The read this surface exists for: an improvement loop enumerates every grading the workspace
+ * has produced without naming a run or a task first, which is the one thing it cannot know
+ * (finding out is the question it is asking). `?acknowledged=false` is the backlog, and paging
+ * is keyset, so a poll loop can never skip an entry because a run finished mid-page.
+ */
+export declare const listPublicKaizenEntriesContract: {
+    readonly method: "get";
+    readonly requestQuerySchema: import("valibot").ObjectSchema<{
+        readonly limit: import("valibot").OptionalSchema<import("valibot").SchemaWithPipe<readonly [import("valibot").StringSchema<undefined>, import("valibot").RegexAction<string, "Must be a whole number">, import("valibot").TransformAction<any, number>, import("valibot").NumberSchema<undefined>, import("valibot").IntegerAction<number, undefined>, import("valibot").MinValueAction<number, 1, undefined>, import("valibot").MaxValueAction<number, 100, undefined>]>, undefined>;
+        readonly cursor: import("valibot").OptionalSchema<import("valibot").SchemaWithPipe<readonly [import("valibot").StringSchema<undefined>, import("valibot").TrimAction, import("valibot").MinLengthAction<string, 1, undefined>, import("valibot").MaxLengthAction<string, 200, undefined>]>, undefined>;
+        readonly acknowledged: import("valibot").OptionalSchema<import("valibot").SchemaWithPipe<readonly [import("valibot").PicklistSchema<["true", "false"], undefined>, import("valibot").TransformAction<"false" | "true", boolean>]>, undefined>;
+        readonly settled: import("valibot").OptionalSchema<import("valibot").SchemaWithPipe<readonly [import("valibot").PicklistSchema<["true", "false"], undefined>, import("valibot").TransformAction<"false" | "true", boolean>]>, undefined>;
+        readonly status: import("valibot").OptionalSchema<import("valibot").PicklistSchema<["scheduled", "running", "complete", "failed"], undefined>, undefined>;
+        readonly agentKind: import("valibot").OptionalSchema<import("valibot").SchemaWithPipe<readonly [import("valibot").StringSchema<undefined>, import("valibot").TrimAction, import("valibot").MinLengthAction<string, 1, undefined>, import("valibot").MaxLengthAction<string, 120, undefined>]>, undefined>;
+        readonly since: import("valibot").OptionalSchema<import("valibot").SchemaWithPipe<readonly [import("valibot").StringSchema<undefined>, import("valibot").RegexAction<string, "Must be a whole number of epoch milliseconds">, import("valibot").TransformAction<any, number>, import("valibot").NumberSchema<undefined>, import("valibot").IntegerAction<number, undefined>, import("valibot").MinValueAction<number, 0, undefined>]>, undefined>;
+    }, undefined>;
+    readonly pathResolver: () => string;
+    readonly responsesByStatusCode: {
+        readonly '4xx': import("valibot").ObjectSchema<{
+            readonly error: import("valibot").ObjectSchema<{
+                readonly code: import("valibot").StringSchema<undefined>;
+                readonly message: import("valibot").StringSchema<undefined>;
+                readonly details: import("valibot").OptionalSchema<import("valibot").UnknownSchema, undefined>;
+                readonly issues: import("valibot").OptionalSchema<import("valibot").ArraySchema<import("valibot").ObjectSchema<{
+                    readonly path: import("valibot").OptionalSchema<import("valibot").StringSchema<undefined>, undefined>;
+                    readonly message: import("valibot").StringSchema<undefined>;
+                }, undefined>, undefined>, undefined>;
+            }, undefined>;
+        }, undefined>;
+        readonly '5xx': import("valibot").ObjectSchema<{
+            readonly error: import("valibot").ObjectSchema<{
+                readonly code: import("valibot").StringSchema<undefined>;
+                readonly message: import("valibot").StringSchema<undefined>;
+                readonly details: import("valibot").OptionalSchema<import("valibot").UnknownSchema, undefined>;
+                readonly issues: import("valibot").OptionalSchema<import("valibot").ArraySchema<import("valibot").ObjectSchema<{
+                    readonly path: import("valibot").OptionalSchema<import("valibot").StringSchema<undefined>, undefined>;
+                    readonly message: import("valibot").StringSchema<undefined>;
+                }, undefined>, undefined>, undefined>;
+            }, undefined>;
+        }, undefined>;
+        readonly 200: import("valibot").ObjectSchema<{
+            readonly entries: import("valibot").ArraySchema<import("valibot").ObjectSchema<{
+                readonly entryId: import("valibot").StringSchema<undefined>;
+                readonly runId: import("valibot").StringSchema<undefined>;
+                readonly stepIndex: import("valibot").NumberSchema<undefined>;
+                readonly taskId: import("valibot").StringSchema<undefined>;
+                readonly task: import("valibot").NullableSchema<import("valibot").ObjectSchema<{
+                    readonly title: import("valibot").StringSchema<undefined>;
+                    readonly status: import("valibot").PicklistSchema<["planned", "ready", "in_progress", "blocked", "pr_ready", "done"], undefined>;
+                    readonly serviceId: import("valibot").NullableSchema<import("valibot").StringSchema<undefined>, undefined>;
+                    readonly serviceTitle: import("valibot").NullableSchema<import("valibot").StringSchema<undefined>, undefined>;
+                }, undefined>, undefined>;
+                readonly agentKind: import("valibot").StringSchema<undefined>;
+                readonly model: import("valibot").StringSchema<undefined>;
+                readonly promptVersion: import("valibot").NumberSchema<undefined>;
+                readonly comboKey: import("valibot").StringSchema<undefined>;
+                readonly combo: import("valibot").NullableSchema<import("valibot").ObjectSchema<{
+                    readonly consecutiveHighGrades: import("valibot").NumberSchema<undefined>;
+                    readonly verified: import("valibot").BooleanSchema<undefined>;
+                    readonly verifiedAt: import("valibot").NullableSchema<import("valibot").NumberSchema<undefined>, undefined>;
+                }, undefined>, undefined>;
+                readonly status: import("valibot").PicklistSchema<["scheduled", "running", "complete", "failed"], undefined>;
+                readonly grade: import("valibot").NullableSchema<import("valibot").NumberSchema<undefined>, undefined>;
+                readonly summary: import("valibot").StringSchema<undefined>;
+                readonly recommendations: import("valibot").ArraySchema<import("valibot").StringSchema<undefined>, undefined>;
+                readonly graderModel: import("valibot").NullableSchema<import("valibot").StringSchema<undefined>, undefined>;
+                readonly error: import("valibot").NullableSchema<import("valibot").StringSchema<undefined>, undefined>;
+                readonly acknowledged: import("valibot").BooleanSchema<undefined>;
+                readonly acknowledgedAt: import("valibot").NullableSchema<import("valibot").NumberSchema<undefined>, undefined>;
+                readonly acknowledgedBy: import("valibot").NullableSchema<import("valibot").StringSchema<undefined>, undefined>;
+                readonly acknowledgementNote: import("valibot").NullableSchema<import("valibot").StringSchema<undefined>, undefined>;
+                readonly createdAt: import("valibot").NumberSchema<undefined>;
+                readonly updatedAt: import("valibot").NumberSchema<undefined>;
+            }, undefined>, undefined>;
+            readonly nextCursor: import("valibot").NullableSchema<import("valibot").StringSchema<undefined>, undefined>;
+        }, undefined>;
+    };
+} & {
+    readonly minScope: "read";
+};
+/**
+ * One entry by id: the read-back beside the acknowledge write, so a caller holding an `entryId`
+ * (from a page it stored, or from a ticket it filed) can re-read the current grade, its
+ * recommendations and its triage state rather than re-paging the list to find it.
+ */
+export declare const getPublicKaizenEntryContract: {
+    readonly method: "get";
+    readonly requestPathParamsSchema: import("valibot").ObjectSchema<{
+        entryId: import("valibot").StringSchema<undefined>;
+    }, undefined> & import("@toad-contracts/core").StandardObjectKeysV1<unknown, unknown>;
+    readonly pathResolver: ({ entryId }: {
+        entryId: string;
+    }) => string;
+    readonly responsesByStatusCode: {
+        readonly '4xx': import("valibot").ObjectSchema<{
+            readonly error: import("valibot").ObjectSchema<{
+                readonly code: import("valibot").StringSchema<undefined>;
+                readonly message: import("valibot").StringSchema<undefined>;
+                readonly details: import("valibot").OptionalSchema<import("valibot").UnknownSchema, undefined>;
+                readonly issues: import("valibot").OptionalSchema<import("valibot").ArraySchema<import("valibot").ObjectSchema<{
+                    readonly path: import("valibot").OptionalSchema<import("valibot").StringSchema<undefined>, undefined>;
+                    readonly message: import("valibot").StringSchema<undefined>;
+                }, undefined>, undefined>, undefined>;
+            }, undefined>;
+        }, undefined>;
+        readonly '5xx': import("valibot").ObjectSchema<{
+            readonly error: import("valibot").ObjectSchema<{
+                readonly code: import("valibot").StringSchema<undefined>;
+                readonly message: import("valibot").StringSchema<undefined>;
+                readonly details: import("valibot").OptionalSchema<import("valibot").UnknownSchema, undefined>;
+                readonly issues: import("valibot").OptionalSchema<import("valibot").ArraySchema<import("valibot").ObjectSchema<{
+                    readonly path: import("valibot").OptionalSchema<import("valibot").StringSchema<undefined>, undefined>;
+                    readonly message: import("valibot").StringSchema<undefined>;
+                }, undefined>, undefined>, undefined>;
+            }, undefined>;
+        }, undefined>;
+        readonly 200: import("valibot").ObjectSchema<{
+            readonly entryId: import("valibot").StringSchema<undefined>;
+            readonly runId: import("valibot").StringSchema<undefined>;
+            readonly stepIndex: import("valibot").NumberSchema<undefined>;
+            readonly taskId: import("valibot").StringSchema<undefined>;
+            readonly task: import("valibot").NullableSchema<import("valibot").ObjectSchema<{
+                readonly title: import("valibot").StringSchema<undefined>;
+                readonly status: import("valibot").PicklistSchema<["planned", "ready", "in_progress", "blocked", "pr_ready", "done"], undefined>;
+                readonly serviceId: import("valibot").NullableSchema<import("valibot").StringSchema<undefined>, undefined>;
+                readonly serviceTitle: import("valibot").NullableSchema<import("valibot").StringSchema<undefined>, undefined>;
+            }, undefined>, undefined>;
+            readonly agentKind: import("valibot").StringSchema<undefined>;
+            readonly model: import("valibot").StringSchema<undefined>;
+            readonly promptVersion: import("valibot").NumberSchema<undefined>;
+            readonly comboKey: import("valibot").StringSchema<undefined>;
+            readonly combo: import("valibot").NullableSchema<import("valibot").ObjectSchema<{
+                readonly consecutiveHighGrades: import("valibot").NumberSchema<undefined>;
+                readonly verified: import("valibot").BooleanSchema<undefined>;
+                readonly verifiedAt: import("valibot").NullableSchema<import("valibot").NumberSchema<undefined>, undefined>;
+            }, undefined>, undefined>;
+            readonly status: import("valibot").PicklistSchema<["scheduled", "running", "complete", "failed"], undefined>;
+            readonly grade: import("valibot").NullableSchema<import("valibot").NumberSchema<undefined>, undefined>;
+            readonly summary: import("valibot").StringSchema<undefined>;
+            readonly recommendations: import("valibot").ArraySchema<import("valibot").StringSchema<undefined>, undefined>;
+            readonly graderModel: import("valibot").NullableSchema<import("valibot").StringSchema<undefined>, undefined>;
+            readonly error: import("valibot").NullableSchema<import("valibot").StringSchema<undefined>, undefined>;
+            readonly acknowledged: import("valibot").BooleanSchema<undefined>;
+            readonly acknowledgedAt: import("valibot").NullableSchema<import("valibot").NumberSchema<undefined>, undefined>;
+            readonly acknowledgedBy: import("valibot").NullableSchema<import("valibot").StringSchema<undefined>, undefined>;
+            readonly acknowledgementNote: import("valibot").NullableSchema<import("valibot").StringSchema<undefined>, undefined>;
+            readonly createdAt: import("valibot").NumberSchema<undefined>;
+            readonly updatedAt: import("valibot").NumberSchema<undefined>;
+        }, undefined>;
+    };
+} & {
+    readonly minScope: "read";
+};
+/**
+ * Record (or clear) that an entry has been triaged, and answer with the updated entry.
+ *
+ * `write`, not `admin`: acknowledging is bookkeeping about work a human has already read. The
+ * body is optional in practice (an empty `{}` acknowledges), and acknowledging an
+ * already-acknowledged entry is a no-op that returns it unchanged, so a retrying client cannot
+ * rewrite when the entry was first triaged. An entry the grader has not settled yet is refused
+ * `409` with `details.reason: "kaizen_entry_not_settled"`, because there are no recommendations
+ * to have triaged.
+ */
+export declare const acknowledgePublicKaizenEntryContract: {
+    readonly method: "post";
+    readonly requestPathParamsSchema: import("valibot").ObjectSchema<{
+        entryId: import("valibot").StringSchema<undefined>;
+    }, undefined> & import("@toad-contracts/core").StandardObjectKeysV1<unknown, unknown>;
+    readonly pathResolver: ({ entryId }: {
+        entryId: string;
+    }) => string;
+    readonly requestBodySchema: import("valibot").ObjectSchema<{
+        readonly acknowledged: import("valibot").OptionalSchema<import("valibot").BooleanSchema<undefined>, undefined>;
+        readonly note: import("valibot").OptionalSchema<import("valibot").NullableSchema<import("valibot").SchemaWithPipe<readonly [import("valibot").StringSchema<undefined>, import("valibot").TrimAction, import("valibot").MaxLengthAction<string, 2000, undefined>]>, undefined>, undefined>;
+    }, undefined>;
+    readonly responsesByStatusCode: {
+        readonly '4xx': import("valibot").ObjectSchema<{
+            readonly error: import("valibot").ObjectSchema<{
+                readonly code: import("valibot").StringSchema<undefined>;
+                readonly message: import("valibot").StringSchema<undefined>;
+                readonly details: import("valibot").OptionalSchema<import("valibot").UnknownSchema, undefined>;
+                readonly issues: import("valibot").OptionalSchema<import("valibot").ArraySchema<import("valibot").ObjectSchema<{
+                    readonly path: import("valibot").OptionalSchema<import("valibot").StringSchema<undefined>, undefined>;
+                    readonly message: import("valibot").StringSchema<undefined>;
+                }, undefined>, undefined>, undefined>;
+            }, undefined>;
+        }, undefined>;
+        readonly '5xx': import("valibot").ObjectSchema<{
+            readonly error: import("valibot").ObjectSchema<{
+                readonly code: import("valibot").StringSchema<undefined>;
+                readonly message: import("valibot").StringSchema<undefined>;
+                readonly details: import("valibot").OptionalSchema<import("valibot").UnknownSchema, undefined>;
+                readonly issues: import("valibot").OptionalSchema<import("valibot").ArraySchema<import("valibot").ObjectSchema<{
+                    readonly path: import("valibot").OptionalSchema<import("valibot").StringSchema<undefined>, undefined>;
+                    readonly message: import("valibot").StringSchema<undefined>;
+                }, undefined>, undefined>, undefined>;
+            }, undefined>;
+        }, undefined>;
+        readonly 200: import("valibot").ObjectSchema<{
+            readonly entryId: import("valibot").StringSchema<undefined>;
+            readonly runId: import("valibot").StringSchema<undefined>;
+            readonly stepIndex: import("valibot").NumberSchema<undefined>;
+            readonly taskId: import("valibot").StringSchema<undefined>;
+            readonly task: import("valibot").NullableSchema<import("valibot").ObjectSchema<{
+                readonly title: import("valibot").StringSchema<undefined>;
+                readonly status: import("valibot").PicklistSchema<["planned", "ready", "in_progress", "blocked", "pr_ready", "done"], undefined>;
+                readonly serviceId: import("valibot").NullableSchema<import("valibot").StringSchema<undefined>, undefined>;
+                readonly serviceTitle: import("valibot").NullableSchema<import("valibot").StringSchema<undefined>, undefined>;
+            }, undefined>, undefined>;
+            readonly agentKind: import("valibot").StringSchema<undefined>;
+            readonly model: import("valibot").StringSchema<undefined>;
+            readonly promptVersion: import("valibot").NumberSchema<undefined>;
+            readonly comboKey: import("valibot").StringSchema<undefined>;
+            readonly combo: import("valibot").NullableSchema<import("valibot").ObjectSchema<{
+                readonly consecutiveHighGrades: import("valibot").NumberSchema<undefined>;
+                readonly verified: import("valibot").BooleanSchema<undefined>;
+                readonly verifiedAt: import("valibot").NullableSchema<import("valibot").NumberSchema<undefined>, undefined>;
+            }, undefined>, undefined>;
+            readonly status: import("valibot").PicklistSchema<["scheduled", "running", "complete", "failed"], undefined>;
+            readonly grade: import("valibot").NullableSchema<import("valibot").NumberSchema<undefined>, undefined>;
+            readonly summary: import("valibot").StringSchema<undefined>;
+            readonly recommendations: import("valibot").ArraySchema<import("valibot").StringSchema<undefined>, undefined>;
+            readonly graderModel: import("valibot").NullableSchema<import("valibot").StringSchema<undefined>, undefined>;
+            readonly error: import("valibot").NullableSchema<import("valibot").StringSchema<undefined>, undefined>;
+            readonly acknowledged: import("valibot").BooleanSchema<undefined>;
+            readonly acknowledgedAt: import("valibot").NullableSchema<import("valibot").NumberSchema<undefined>, undefined>;
+            readonly acknowledgedBy: import("valibot").NullableSchema<import("valibot").StringSchema<undefined>, undefined>;
+            readonly acknowledgementNote: import("valibot").NullableSchema<import("valibot").StringSchema<undefined>, undefined>;
+            readonly createdAt: import("valibot").NumberSchema<undefined>;
+            readonly updatedAt: import("valibot").NumberSchema<undefined>;
+        }, undefined>;
+    };
+} & {
+    readonly minScope: "write";
+};
+//# sourceMappingURL=public-kaizen.d.ts.map

package/dist/routes/public-kaizen.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"public-kaizen.d.ts","sourceRoot":"","sources":["../../src/routes/public-kaizen.ts"],"names":[],"mappings":"AA4BA;;;;;;;;GAQG;AACH,eAAO,MAAM,+BAA+B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAQ3C,CAAA;AAED;;;;GAIG;AACH,eAAO,MAAM,4BAA4B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAQxC,CAAA;AAED;;;;;;;;;GASG;AACH,eAAO,MAAM,oCAAoC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAShD,CAAA"}

package/dist/routes/public-kaizen.js

@@ -0,0 +1,64 @@
+import { defineApiContract } from '@toad-contracts/valibot';
+import { acknowledgeKaizenEntrySchema, listPublicKaizenEntriesQuerySchema, publicKaizenEntryListSchema, publicKaizenEntrySchema, } from '../public-kaizen.js';
+import { errorResponses, singleStringParam, withMinScope } from './_shared.js';
+// ---------------------------------------------------------------------------
+// Route contracts for the public KAIZEN surface: absolute `/api/v1` paths, authenticated
+// in-controller by a public-API key. The wire shapes and the reasoning behind them live in
+// `../public-kaizen.ts`; the grading machinery behind an entry is `KaizenService`, and the
+// surface's own account for an integrator is `backend/docs/public-api.md`.
+//
+// The scope split follows the one the merge-evidence surface established. Reading gradings is
+// `read` like every other read on this API. ACKNOWLEDGING is `write`, not `admin`: it records
+// that a person has triaged a recommendation, which starts nothing, spends nothing and merges
+// nothing. Requiring `admin` for it would mean an integration whose whole job is draining the
+// improvement backlog had to hold a key that also deletes tasks and merges pull requests.
+//
+// The entries are addressed by ENTRY id under `/api/v1/kaizen/entries`, and both point routes
+// re-apply the key's workspace to the row they load, the rule every point read on this API
+// follows (`/api/v1/debug/llm-calls/:callId`, `/api/v1/merge-records/:recordId`).
+// ---------------------------------------------------------------------------
+const entryIdParams = singleStringParam('entryId');
+/**
+ * One page of the workspace's Kaizen entries, newest first, with the acknowledgement / status /
+ * agent-kind / since filters applied in SQL.
+ *
+ * The read this surface exists for: an improvement loop enumerates every grading the workspace
+ * has produced without naming a run or a task first, which is the one thing it cannot know
+ * (finding out is the question it is asking). `?acknowledged=false` is the backlog, and paging
+ * is keyset, so a poll loop can never skip an entry because a run finished mid-page.
+ */
+export const listPublicKaizenEntriesContract = withMinScope('read', defineApiContract({
+    method: 'get',
+    requestQuerySchema: listPublicKaizenEntriesQuerySchema,
+    pathResolver: () => '/api/v1/kaizen/entries',
+    responsesByStatusCode: { 200: publicKaizenEntryListSchema, ...errorResponses },
+}));
+/**
+ * One entry by id: the read-back beside the acknowledge write, so a caller holding an `entryId`
+ * (from a page it stored, or from a ticket it filed) can re-read the current grade, its
+ * recommendations and its triage state rather than re-paging the list to find it.
+ */
+export const getPublicKaizenEntryContract = withMinScope('read', defineApiContract({
+    method: 'get',
+    requestPathParamsSchema: entryIdParams,
+    pathResolver: ({ entryId }) => `/api/v1/kaizen/entries/${entryId}`,
+    responsesByStatusCode: { 200: publicKaizenEntrySchema, ...errorResponses },
+}));
+/**
+ * Record (or clear) that an entry has been triaged, and answer with the updated entry.
+ *
+ * `write`, not `admin`: acknowledging is bookkeeping about work a human has already read. The
+ * body is optional in practice (an empty `{}` acknowledges), and acknowledging an
+ * already-acknowledged entry is a no-op that returns it unchanged, so a retrying client cannot
+ * rewrite when the entry was first triaged. An entry the grader has not settled yet is refused
+ * `409` with `details.reason: "kaizen_entry_not_settled"`, because there are no recommendations
+ * to have triaged.
+ */
+export const acknowledgePublicKaizenEntryContract = withMinScope('write', defineApiContract({
+    method: 'post',
+    requestPathParamsSchema: entryIdParams,
+    pathResolver: ({ entryId }) => `/api/v1/kaizen/entries/${entryId}/acknowledge`,
+    requestBodySchema: acknowledgeKaizenEntrySchema,
+    responsesByStatusCode: { 200: publicKaizenEntrySchema, ...errorResponses },
+}));
+//# sourceMappingURL=public-kaizen.js.map

package/dist/routes/public-kaizen.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"public-kaizen.js","sourceRoot":"","sources":["../../src/routes/public-kaizen.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAA;AAC3D,OAAO,EACL,4BAA4B,EAC5B,kCAAkC,EAClC,2BAA2B,EAC3B,uBAAuB,GACxB,MAAM,qBAAqB,CAAA;AAC5B,OAAO,EAAE,cAAc,EAAE,iBAAiB,EAAE,YAAY,EAAE,MAAM,cAAc,CAAA;AAE9E,8EAA8E;AAC9E,yFAAyF;AACzF,2FAA2F;AAC3F,2FAA2F;AAC3F,2EAA2E;AAC3E,EAAE;AACF,8FAA8F;AAC9F,8FAA8F;AAC9F,8FAA8F;AAC9F,8FAA8F;AAC9F,0FAA0F;AAC1F,EAAE;AACF,8FAA8F;AAC9F,2FAA2F;AAC3F,kFAAkF;AAClF,8EAA8E;AAE9E,MAAM,aAAa,GAAG,iBAAiB,CAAC,SAAS,CAAC,CAAA;AAElD;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,+BAA+B,GAAG,YAAY,CACzD,MAAM,EACN,iBAAiB,CAAC;IAChB,MAAM,EAAE,KAAK;IACb,kBAAkB,EAAE,kCAAkC;IACtD,YAAY,EAAE,GAAG,EAAE,CAAC,wBAAwB;IAC5C,qBAAqB,EAAE,EAAE,GAAG,EAAE,2BAA2B,EAAE,GAAG,cAAc,EAAE;CAC/E,CAAC,CACH,CAAA;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAG,YAAY,CACtD,MAAM,EACN,iBAAiB,CAAC;IAChB,MAAM,EAAE,KAAK;IACb,uBAAuB,EAAE,aAAa;IACtC,YAAY,EAAE,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,0BAA0B,OAAO,EAAE;IAClE,qBAAqB,EAAE,EAAE,GAAG,EAAE,uBAAuB,EAAE,GAAG,cAAc,EAAE;CAC3E,CAAC,CACH,CAAA;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,oCAAoC,GAAG,YAAY,CAC9D,OAAO,EACP,iBAAiB,CAAC;IAChB,MAAM,EAAE,MAAM;IACd,uBAAuB,EAAE,aAAa;IACtC,YAAY,EAAE,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,0BAA0B,OAAO,cAAc;IAC9E,iBAAiB,EAAE,4BAA4B;IAC/C,qBAAqB,EAAE,EAAE,GAAG,EAAE,uBAAuB,EAAE,GAAG,cAAc,EAAE;CAC3E,CAAC,CACH,CAAA"}

package/dist/routes/public-provisioning.d.ts

@@ -201,6 +201,84 @@ export declare const linkPublicRepoContract: {
 } & {
     readonly minScope: "admin";
 };
+/**
+ * Read ONE file from a repository this workspace has linked, at a ref.
+ *
+ * What it exists for is grading what a run actually COMMITTED, which nothing on this surface could
+ * answer: `GET /repos` lists rows, `/repos/available` answers reachability, and
+ * `GET /services/:id/spec` serves the one tree the platform understands. Everything else was the
+ * agent's own prose, so a caller wanting a real answer had to hold a second VCS credential.
+ *
+ * **`path` is a QUERY parameter, not the rest of the URL**, which is the one place this deliberately
+ * departs from the shape a provider's own API uses. A repo-relative path contains slashes, and a
+ * path SEGMENT cannot: OpenAPI 3 path templating does not admit them, so a `.../contents/{path}`
+ * would be unrepresentable in the spec the four SDK clients are generated from, and the router would
+ * match one segment and 404 everything nested. As a query value it needs one ordinary encoding and
+ * every generated client passes it without a special case.
+ *
+ * `ref` is a branch, tag or commit sha. Omitted, it is passed through omitted, so the PROVIDER
+ * resolves the repository's own default branch: the platform's recorded default may be a value it
+ * invented for a projection row that carries none, and pinning that would read a branch the
+ * repository need not have. The response then reports `ref: null` and the `sha` it did read.
+ *
+ * Five outcomes a caller branches on, and none of them are folded: `404` with
+ * `details.reason: 'repo_not_linked'` for a repository this workspace has not adopted, `404` with
+ * `'file_not_found'` for a path the ref does not hold, `422` with `'file_too_large'` for a file past
+ * `MAX_REPO_FILE_CHARS` (plus `size` and `limit`) or past the provider's own contents ceiling (plus
+ * `limit` alone, since nothing measured it), refused rather than truncated because a shortened
+ * answer reads exactly like a shorter file, `422` with `'file_not_text'` (plus `sha`) for bytes that
+ * are not UTF-8, and `503` when the deployment's VCS integration is unwired or the provider could
+ * not be reached, which is not evidence about the file.
+ */
+export declare const getPublicRepoFileContract: {
+    readonly method: "get";
+    readonly requestPathParamsSchema: v.ObjectSchema<{
+        readonly owner: v.StringSchema<undefined>;
+        readonly name: v.StringSchema<undefined>;
+    }, undefined> & import("@toad-contracts/core").StandardObjectKeysV1<unknown, unknown>;
+    readonly pathResolver: ({ owner, name }: {
+        owner: string;
+        name: string;
+    }) => string;
+    readonly requestQuerySchema: v.ObjectSchema<{
+        readonly path: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 1000, undefined>, v.CheckAction<string, "A path is relative to the repository root">, v.CheckAction<string, "No path segment may be '..'">]>;
+        readonly ref: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 255, undefined>]>, undefined>;
+    }, undefined>;
+    readonly responsesByStatusCode: {
+        readonly '4xx': v.ObjectSchema<{
+            readonly error: v.ObjectSchema<{
+                readonly code: v.StringSchema<undefined>;
+                readonly message: v.StringSchema<undefined>;
+                readonly details: v.OptionalSchema<v.UnknownSchema, undefined>;
+                readonly issues: v.OptionalSchema<v.ArraySchema<v.ObjectSchema<{
+                    readonly path: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+                    readonly message: v.StringSchema<undefined>;
+                }, undefined>, undefined>, undefined>;
+            }, undefined>;
+        }, undefined>;
+        readonly '5xx': v.ObjectSchema<{
+            readonly error: v.ObjectSchema<{
+                readonly code: v.StringSchema<undefined>;
+                readonly message: v.StringSchema<undefined>;
+                readonly details: v.OptionalSchema<v.UnknownSchema, undefined>;
+                readonly issues: v.OptionalSchema<v.ArraySchema<v.ObjectSchema<{
+                    readonly path: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+                    readonly message: v.StringSchema<undefined>;
+                }, undefined>, undefined>, undefined>;
+            }, undefined>;
+        }, undefined>;
+        readonly 200: v.ObjectSchema<{
+            readonly owner: v.StringSchema<undefined>;
+            readonly name: v.StringSchema<undefined>;
+            readonly path: v.StringSchema<undefined>;
+            readonly ref: v.NullableSchema<v.StringSchema<undefined>, undefined>;
+            readonly sha: v.StringSchema<undefined>;
+            readonly content: v.StringSchema<undefined>;
+        }, undefined>;
+    };
+} & {
+    readonly minScope: "admin";
+};
 /** Poll one bootstrap run. Idempotent, and the only way to learn a run's outcome. */
 export declare const getPublicRepoBootstrapContract: {
     readonly method: "get";
@@ -427,6 +505,63 @@ export declare const connectPublicEnvironmentContract: {
 } & {
     readonly minScope: "admin";
 };
+/**
+ * Every environment handler this workspace holds, with the secret KEYS each carries and no values.
+ *
+ * The half that was missing: handlers could be WRITTEN here and never read. A deployment that seeds
+ * them programmatically (the documented path for a multi-tenant Node deployment, and the one local
+ * mode takes) had no way for a headless caller to confirm the seed landed, so "the backend accepts
+ * our credential" and "this workspace has a handler for that backend" collapsed into one
+ * unanswerable question. They are different failures with different fixes.
+ *
+ * It reports every engine, including a `remote-custom` handler for a backend the deployment
+ * registered in code, which is why it does not reuse the connect call's own response shape: that one
+ * pins `engine: 'kubernetes'` truthfully for a write only ever made with it, and widening a shipped
+ * literal would retype a field released clients already narrow on.
+ */
+export declare const listPublicEnvironmentConnectionsContract: {
+    readonly method: "get";
+    readonly pathResolver: () => string;
+    readonly responsesByStatusCode: {
+        readonly '4xx': v.ObjectSchema<{
+            readonly error: v.ObjectSchema<{
+                readonly code: v.StringSchema<undefined>;
+                readonly message: v.StringSchema<undefined>;
+                readonly details: v.OptionalSchema<v.UnknownSchema, undefined>;
+                readonly issues: v.OptionalSchema<v.ArraySchema<v.ObjectSchema<{
+                    readonly path: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+                    readonly message: v.StringSchema<undefined>;
+                }, undefined>, undefined>, undefined>;
+            }, undefined>;
+        }, undefined>;
+        readonly '5xx': v.ObjectSchema<{
+            readonly error: v.ObjectSchema<{
+                readonly code: v.StringSchema<undefined>;
+                readonly message: v.StringSchema<undefined>;
+                readonly details: v.OptionalSchema<v.UnknownSchema, undefined>;
+                readonly issues: v.OptionalSchema<v.ArraySchema<v.ObjectSchema<{
+                    readonly path: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+                    readonly message: v.StringSchema<undefined>;
+                }, undefined>, undefined>, undefined>;
+            }, undefined>;
+        }, undefined>;
+        readonly 200: v.ObjectSchema<{
+            readonly connections: v.ArraySchema<v.ObjectSchema<{
+                readonly provisionType: v.StringSchema<undefined>;
+                readonly manifestId: v.NullableSchema<v.StringSchema<undefined>, undefined>;
+                readonly acceptsManifestId: v.NullableSchema<v.StringSchema<undefined>, undefined>;
+                readonly engine: v.StringSchema<undefined>;
+                readonly backendKind: v.StringSchema<undefined>;
+                readonly label: v.StringSchema<undefined>;
+                readonly endpoint: v.StringSchema<undefined>;
+                readonly secretKeys: v.ArraySchema<v.StringSchema<undefined>, undefined>;
+                readonly connectedAt: v.NumberSchema<undefined>;
+            }, undefined>, undefined>;
+        }, undefined>;
+    };
+} & {
+    readonly minScope: "admin";
+};
 /**
  * Patch a service: its authored fields, and where its per-run manifests live.
  *
@@ -462,6 +597,10 @@ export declare const updatePublicServiceContract: {
                 readonly path: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 500, undefined>]>;
                 readonly renderer: v.OptionalSchema<v.PicklistSchema<["raw", "kustomize"], undefined>, undefined>;
             }, undefined>], undefined>;
+        }, undefined>, v.ObjectSchema<{
+            readonly type: v.LiteralSchema<"custom", undefined>;
+            readonly manifestId: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.RegexAction<string, "Only lowercase letters, digits and hyphens are allowed">, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 64, undefined>]>;
+            readonly manifestPath: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MaxLengthAction<string, 500, undefined>]>, undefined>;
         }, undefined>], undefined>, undefined>;
     }, undefined>, v.CheckAction<{
         title?: string | undefined;
@@ -479,6 +618,10 @@ export declare const updatePublicServiceContract: {
                 path: string;
                 renderer?: "kustomize" | "raw" | undefined;
             };
+        } | {
+            type: "custom";
+            manifestId: string;
+            manifestPath?: string | undefined;
         } | undefined;
     }, "Supply at least one of title, description or provisioning.">]>;
     readonly responsesByStatusCode: {
@@ -523,6 +666,10 @@ export declare const updatePublicServiceContract: {
                     readonly path: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 500, undefined>]>;
                     readonly renderer: v.OptionalSchema<v.PicklistSchema<["raw", "kustomize"], undefined>, undefined>;
                 }, undefined>], undefined>;
+            }, undefined>, v.ObjectSchema<{
+                readonly type: v.LiteralSchema<"custom", undefined>;
+                readonly manifestId: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.RegexAction<string, "Only lowercase letters, digits and hyphens are allowed">, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 64, undefined>]>;
+                readonly manifestPath: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MaxLengthAction<string, 500, undefined>]>, undefined>;
             }, undefined>], undefined>, undefined>;
         }, undefined>;
     };

package/dist/routes/public-provisioning.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"public-provisioning.d.ts","sourceRoot":"","sources":["../../src/routes/public-provisioning.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,SAAS,CAAA;AAiD5B;;;;;;;GAOG;AACH,eAAO,MAAM,gCAAgC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAQ5C,CAAA;AAID;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,gCAAgC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAQ5C,CAAA;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,sBAAsB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAQlC,CAAA;AAED,qFAAqF;AACrF,eAAO,MAAM,8BAA8B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAQ1C,CAAA;AAID;;;;;;;;GAQG;AACH,eAAO,MAAM,uCAAuC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAQnD,CAAA;AAED;;;;;;GAMG;AACH,eAAO,MAAM,gCAAgC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAQ5C,CAAA;AAID;;;;;;;;;;GAUG;AACH,eAAO,MAAM,2BAA2B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CASvC,CAAA;AAID;;;;;;;;GAQG;AACH,eAAO,MAAM,6BAA6B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAOzC,CAAA;AAED;;;;GAIG;AACH,eAAO,MAAM,8BAA8B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAO1C,CAAA;AAED;;;;;;;;GAQG;AACH,eAAO,MAAM,8BAA8B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAO1C,CAAA;AAED;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,8BAA8B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAO1C,CAAA;AAID;;;;;;;GAOG;AACH,eAAO,MAAM,iCAAiC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAO7C,CAAA;AAED;;;;;;;GAOG;AACH,eAAO,MAAM,oCAAoC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAQhD,CAAA"}
+{"version":3,"file":"public-provisioning.d.ts","sourceRoot":"","sources":["../../src/routes/public-provisioning.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,SAAS,CAAA;AAoD5B;;;;;;;GAOG;AACH,eAAO,MAAM,gCAAgC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAQ5C,CAAA;AAID;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,gCAAgC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAQ5C,CAAA;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,sBAAsB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAQlC,CAAA;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,eAAO,MAAM,yBAAyB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAYrC,CAAA;AAED,qFAAqF;AACrF,eAAO,MAAM,8BAA8B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAQ1C,CAAA;AAID;;;;;;;;GAQG;AACH,eAAO,MAAM,uCAAuC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAQnD,CAAA;AAED;;;;;;GAMG;AACH,eAAO,MAAM,gCAAgC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAQ5C,CAAA;AAED;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,wCAAwC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAOpD,CAAA;AAID;;;;;;;;;;GAUG;AACH,eAAO,MAAM,2BAA2B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CASvC,CAAA;AAID;;;;;;;;GAQG;AACH,eAAO,MAAM,6BAA6B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAOzC,CAAA;AAED;;;;GAIG;AACH,eAAO,MAAM,8BAA8B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAO1C,CAAA;AAED;;;;;;;;GAQG;AACH,eAAO,MAAM,8BAA8B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAO1C,CAAA;AAED;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,8BAA8B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAO1C,CAAA;AAID;;;;;;;GAOG;AACH,eAAO,MAAM,iCAAiC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAO7C,CAAA;AAED;;;;;;;GAOG;AACH,eAAO,MAAM,oCAAoC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAQhD,CAAA"}

package/dist/routes/public-provisioning.js

@@ -1,6 +1,6 @@
 import * as v from 'valibot';
-import { defineApiContract } from '@toad-contracts/valibot';
-import { connectPublicEnvironmentSchema, linkPublicRepoSchema, publicAvailableRepoListSchema, publicBootstrapJobSchema, publicBootstrapRepoSchema, publicEnvironmentConnectionTestSchema, publicEnvironmentConnectionViewSchema, publicModelPresetListSchema, publicRiskPolicyListSchema, publicTrackerWritebackSettingsSchema, publicVcsConnectionViewSchema, publicWiredModelListSchema, testPublicEnvironmentConnectionSchema, updatePublicServiceSchema, updatePublicTrackerWritebackSchema, } from '../public-provisioning.js';
+import { defineApiContract, withObjectKeys } from '@toad-contracts/valibot';
+import { connectPublicEnvironmentSchema, linkPublicRepoSchema, publicAvailableRepoListSchema, publicBootstrapJobSchema, publicBootstrapRepoSchema, publicEnvironmentConnectionTestSchema, publicEnvironmentConnectionViewSchema, publicEnvironmentHandlerListSchema, publicModelPresetListSchema, publicRepoFilePathSchema, publicRepoFileSchema, publicRiskPolicyListSchema, publicTrackerWritebackSettingsSchema, publicVcsConnectionViewSchema, publicWiredModelListSchema, testPublicEnvironmentConnectionSchema, updatePublicServiceSchema, updatePublicTrackerWritebackSchema, } from '../public-provisioning.js';
 import { publicServiceSchema } from '../public-api.js';
 import { publicRepoSchema } from '../public-board.js';
 import { errorResponses, singleStringParam, withMinScope } from './_shared.js';
@@ -86,6 +86,45 @@ export const linkPublicRepoContract = withMinScope('admin', defineApiContract({
     requestBodySchema: linkPublicRepoSchema,
     responsesByStatusCode: { 200: publicRepoSchema, ...errorResponses },
 }));
+/**
+ * Read ONE file from a repository this workspace has linked, at a ref.
+ *
+ * What it exists for is grading what a run actually COMMITTED, which nothing on this surface could
+ * answer: `GET /repos` lists rows, `/repos/available` answers reachability, and
+ * `GET /services/:id/spec` serves the one tree the platform understands. Everything else was the
+ * agent's own prose, so a caller wanting a real answer had to hold a second VCS credential.
+ *
+ * **`path` is a QUERY parameter, not the rest of the URL**, which is the one place this deliberately
+ * departs from the shape a provider's own API uses. A repo-relative path contains slashes, and a
+ * path SEGMENT cannot: OpenAPI 3 path templating does not admit them, so a `.../contents/{path}`
+ * would be unrepresentable in the spec the four SDK clients are generated from, and the router would
+ * match one segment and 404 everything nested. As a query value it needs one ordinary encoding and
+ * every generated client passes it without a special case.
+ *
+ * `ref` is a branch, tag or commit sha. Omitted, it is passed through omitted, so the PROVIDER
+ * resolves the repository's own default branch: the platform's recorded default may be a value it
+ * invented for a projection row that carries none, and pinning that would read a branch the
+ * repository need not have. The response then reports `ref: null` and the `sha` it did read.
+ *
+ * Five outcomes a caller branches on, and none of them are folded: `404` with
+ * `details.reason: 'repo_not_linked'` for a repository this workspace has not adopted, `404` with
+ * `'file_not_found'` for a path the ref does not hold, `422` with `'file_too_large'` for a file past
+ * `MAX_REPO_FILE_CHARS` (plus `size` and `limit`) or past the provider's own contents ceiling (plus
+ * `limit` alone, since nothing measured it), refused rather than truncated because a shortened
+ * answer reads exactly like a shorter file, `422` with `'file_not_text'` (plus `sha`) for bytes that
+ * are not UTF-8, and `503` when the deployment's VCS integration is unwired or the provider could
+ * not be reached, which is not evidence about the file.
+ */
+export const getPublicRepoFileContract = withMinScope('admin', defineApiContract({
+    method: 'get',
+    requestPathParamsSchema: withObjectKeys(v.object({ owner: v.string(), name: v.string() })),
+    pathResolver: ({ owner, name }) => `/api/v1/repos/${owner}/${name}/contents`,
+    requestQuerySchema: v.object({
+        path: publicRepoFilePathSchema,
+        ref: v.optional(v.pipe(v.string(), v.trim(), v.minLength(1), v.maxLength(255))),
+    }),
+    responsesByStatusCode: { 200: publicRepoFileSchema, ...errorResponses },
+}));
 /** Poll one bootstrap run. Idempotent, and the only way to learn a run's outcome. */
 export const getPublicRepoBootstrapContract = withMinScope('admin', defineApiContract({
     method: 'get',
@@ -122,6 +161,25 @@ export const connectPublicEnvironmentContract = withMinScope('admin', defineApiC
     requestBodySchema: connectPublicEnvironmentSchema,
     responsesByStatusCode: { 201: publicEnvironmentConnectionViewSchema, ...errorResponses },
 }));
+/**
+ * Every environment handler this workspace holds, with the secret KEYS each carries and no values.
+ *
+ * The half that was missing: handlers could be WRITTEN here and never read. A deployment that seeds
+ * them programmatically (the documented path for a multi-tenant Node deployment, and the one local
+ * mode takes) had no way for a headless caller to confirm the seed landed, so "the backend accepts
+ * our credential" and "this workspace has a handler for that backend" collapsed into one
+ * unanswerable question. They are different failures with different fixes.
+ *
+ * It reports every engine, including a `remote-custom` handler for a backend the deployment
+ * registered in code, which is why it does not reuse the connect call's own response shape: that one
+ * pins `engine: 'kubernetes'` truthfully for a write only ever made with it, and widening a shipped
+ * literal would retype a field released clients already narrow on.
+ */
+export const listPublicEnvironmentConnectionsContract = withMinScope('admin', defineApiContract({
+    method: 'get',
+    pathResolver: () => '/api/v1/environments/connections',
+    responsesByStatusCode: { 200: publicEnvironmentHandlerListSchema, ...errorResponses },
+}));
 // ---- a service's provisioning (the SOURCE half) -----------------------------
 /**
  * Patch a service: its authored fields, and where its per-run manifests live.

package/dist/routes/public-provisioning.js.map

@@ -1 +1 @@
-{"version":3,"file":"public-provisioning.js","sourceRoot":"","sources":["../../src/routes/public-provisioning.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,SAAS,CAAA;AAC5B,OAAO,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAA;AAC3D,OAAO,EACL,8BAA8B,EAC9B,oBAAoB,EACpB,6BAA6B,EAC7B,wBAAwB,EACxB,yBAAyB,EACzB,qCAAqC,EACrC,qCAAqC,EACrC,2BAA2B,EAC3B,0BAA0B,EAC1B,oCAAoC,EACpC,6BAA6B,EAC7B,0BAA0B,EAC1B,qCAAqC,EACrC,yBAAyB,EACzB,kCAAkC,GACnC,MAAM,2BAA2B,CAAA;AAClC,OAAO,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAA;AACtD,OAAO,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAA;AACrD,OAAO,EAAE,cAAc,EAAE,iBAAiB,EAAE,YAAY,EAAE,MAAM,cAAc,CAAA;AAE9E,8EAA8E;AAC9E,uEAAuE;AACvE,EAAE;AACF,kGAAkG;AAClG,gGAAgG;AAChG,oGAAoG;AACpG,oEAAoE;AACpE,EAAE;AACF,+FAA+F;AAC/F,oGAAoG;AACpG,iGAAiG;AACjG,+FAA+F;AAC/F,kGAAkG;AAClG,8FAA8F;AAC9F,oFAAoF;AACpF,EAAE;AACF,oGAAoG;AACpG,iGAAiG;AACjG,0BAA0B;AAC1B,8EAA8E;AAE9E,MAAM,WAAW,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAA;AAC9C,MAAM,eAAe,GAAG,iBAAiB,CAAC,WAAW,CAAC,CAAA;AAEtD,gFAAgF;AAEhF;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,gCAAgC,GAAG,YAAY,CAC1D,OAAO,EACP,iBAAiB,CAAC;IAChB,MAAM,EAAE,MAAM;IACd,YAAY,EAAE,GAAG,EAAE,CAAC,yBAAyB;IAC7C,iBAAiB,EAAE,yBAAyB;IAC5C,qBAAqB,EAAE,EAAE,GAAG,EAAE,wBAAwB,EAAE,GAAG,cAAc,EAAE;CAC5E,CAAC,CACH,CAAA;AAED,iFAAiF;AAEjF;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,MAAM,gCAAgC,GAAG,YAAY,CAC1D,OAAO,EACP,iBAAiB,CAAC;IAChB,MAAM,EAAE,KAAK;IACb,YAAY,EAAE,GAAG,EAAE,CAAC,yBAAyB;IAC7C,kBAAkB,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,CAAC;IAC3D,qBAAqB,EAAE,EAAE,GAAG,EAAE,6BAA6B,EAAE,GAAG,cAAc,EAAE;CACjF,CAAC,CACH,CAAA;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,YAAY,CAChD,OAAO,EACP,iBAAiB,CAAC;IAChB,MAAM,EAAE,MAAM;IACd,YAAY,EAAE,GAAG,EAAE,CAAC,oBAAoB;IACxC,iBAAiB,EAAE,oBAAoB;IACvC,qBAAqB,EAAE,EAAE,GAAG,EAAE,gBAAgB,EAAE,GAAG,cAAc,EAAE;CACpE,CAAC,CACH,CAAA;AAED,qFAAqF;AACrF,MAAM,CAAC,MAAM,8BAA8B,GAAG,YAAY,CACxD,OAAO,EACP,iBAAiB,CAAC;IAChB,MAAM,EAAE,KAAK;IACb,uBAAuB,EAAE,WAAW;IACpC,YAAY,EAAE,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,2BAA2B,KAAK,EAAE;IAC/D,qBAAqB,EAAE,EAAE,GAAG,EAAE,wBAAwB,EAAE,GAAG,cAAc,EAAE;CAC5E,CAAC,CACH,CAAA;AAED,gFAAgF;AAEhF;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,uCAAuC,GAAG,YAAY,CACjE,OAAO,EACP,iBAAiB,CAAC;IAChB,MAAM,EAAE,MAAM;IACd,YAAY,EAAE,GAAG,EAAE,CAAC,uCAAuC;IAC3D,iBAAiB,EAAE,qCAAqC;IACxD,qBAAqB,EAAE,EAAE,GAAG,EAAE,qCAAqC,EAAE,GAAG,cAAc,EAAE;CACzF,CAAC,CACH,CAAA;AAED;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,gCAAgC,GAAG,YAAY,CAC1D,OAAO,EACP,iBAAiB,CAAC;IAChB,MAAM,EAAE,MAAM;IACd,YAAY,EAAE,GAAG,EAAE,CAAC,kCAAkC;IACtD,iBAAiB,EAAE,8BAA8B;IACjD,qBAAqB,EAAE,EAAE,GAAG,EAAE,qCAAqC,EAAE,GAAG,cAAc,EAAE;CACzF,CAAC,CACH,CAAA;AAED,gFAAgF;AAEhF;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,YAAY,CACrD,OAAO,EACP,iBAAiB,CAAC;IAChB,MAAM,EAAE,OAAO;IACf,uBAAuB,EAAE,eAAe;IACxC,YAAY,EAAE,CAAC,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC,oBAAoB,SAAS,EAAE;IAChE,iBAAiB,EAAE,yBAAyB;IAC5C,qBAAqB,EAAE,EAAE,GAAG,EAAE,mBAAmB,EAAE,GAAG,cAAc,EAAE;CACvE,CAAC,CACH,CAAA;AAED,gFAAgF;AAEhF;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAG,YAAY,CACvD,OAAO,EACP,iBAAiB,CAAC;IAChB,MAAM,EAAE,KAAK;IACb,YAAY,EAAE,GAAG,EAAE,CAAC,gBAAgB;IACpC,qBAAqB,EAAE,EAAE,GAAG,EAAE,0BAA0B,EAAE,GAAG,cAAc,EAAE;CAC9E,CAAC,CACH,CAAA;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,8BAA8B,GAAG,YAAY,CACxD,OAAO,EACP,iBAAiB,CAAC;IAChB,MAAM,EAAE,KAAK;IACb,YAAY,EAAE,GAAG,EAAE,CAAC,wBAAwB;IAC5C,qBAAqB,EAAE,EAAE,GAAG,EAAE,6BAA6B,EAAE,GAAG,cAAc,EAAE;CACjF,CAAC,CACH,CAAA;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,8BAA8B,GAAG,YAAY,CACxD,OAAO,EACP,iBAAiB,CAAC;IAChB,MAAM,EAAE,KAAK;IACb,YAAY,EAAE,GAAG,EAAE,CAAC,uBAAuB;IAC3C,qBAAqB,EAAE,EAAE,GAAG,EAAE,0BAA0B,EAAE,GAAG,cAAc,EAAE;CAC9E,CAAC,CACH,CAAA;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,MAAM,8BAA8B,GAAG,YAAY,CACxD,OAAO,EACP,iBAAiB,CAAC;IAChB,MAAM,EAAE,KAAK;IACb,YAAY,EAAE,GAAG,EAAE,CAAC,uBAAuB;IAC3C,qBAAqB,EAAE,EAAE,GAAG,EAAE,2BAA2B,EAAE,GAAG,cAAc,EAAE;CAC/E,CAAC,CACH,CAAA;AAED,iFAAiF;AAEjF;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,iCAAiC,GAAG,YAAY,CAC3D,OAAO,EACP,iBAAiB,CAAC;IAChB,MAAM,EAAE,KAAK;IACb,YAAY,EAAE,GAAG,EAAE,CAAC,2BAA2B;IAC/C,qBAAqB,EAAE,EAAE,GAAG,EAAE,oCAAoC,EAAE,GAAG,cAAc,EAAE;CACxF,CAAC,CACH,CAAA;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,oCAAoC,GAAG,YAAY,CAC9D,OAAO,EACP,iBAAiB,CAAC;IAChB,MAAM,EAAE,OAAO;IACf,YAAY,EAAE,GAAG,EAAE,CAAC,2BAA2B;IAC/C,iBAAiB,EAAE,kCAAkC;IACrD,qBAAqB,EAAE,EAAE,GAAG,EAAE,oCAAoC,EAAE,GAAG,cAAc,EAAE;CACxF,CAAC,CACH,CAAA"}
+{"version":3,"file":"public-provisioning.js","sourceRoot":"","sources":["../../src/routes/public-provisioning.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,SAAS,CAAA;AAC5B,OAAO,EAAE,iBAAiB,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAA;AAC3E,OAAO,EACL,8BAA8B,EAC9B,oBAAoB,EACpB,6BAA6B,EAC7B,wBAAwB,EACxB,yBAAyB,EACzB,qCAAqC,EACrC,qCAAqC,EACrC,kCAAkC,EAClC,2BAA2B,EAC3B,wBAAwB,EACxB,oBAAoB,EACpB,0BAA0B,EAC1B,oCAAoC,EACpC,6BAA6B,EAC7B,0BAA0B,EAC1B,qCAAqC,EACrC,yBAAyB,EACzB,kCAAkC,GACnC,MAAM,2BAA2B,CAAA;AAClC,OAAO,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAA;AACtD,OAAO,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAA;AACrD,OAAO,EAAE,cAAc,EAAE,iBAAiB,EAAE,YAAY,EAAE,MAAM,cAAc,CAAA;AAE9E,8EAA8E;AAC9E,uEAAuE;AACvE,EAAE;AACF,kGAAkG;AAClG,gGAAgG;AAChG,oGAAoG;AACpG,oEAAoE;AACpE,EAAE;AACF,+FAA+F;AAC/F,oGAAoG;AACpG,iGAAiG;AACjG,+FAA+F;AAC/F,kGAAkG;AAClG,8FAA8F;AAC9F,oFAAoF;AACpF,EAAE;AACF,oGAAoG;AACpG,iGAAiG;AACjG,0BAA0B;AAC1B,8EAA8E;AAE9E,MAAM,WAAW,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAA;AAC9C,MAAM,eAAe,GAAG,iBAAiB,CAAC,WAAW,CAAC,CAAA;AAEtD,gFAAgF;AAEhF;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,gCAAgC,GAAG,YAAY,CAC1D,OAAO,EACP,iBAAiB,CAAC;IAChB,MAAM,EAAE,MAAM;IACd,YAAY,EAAE,GAAG,EAAE,CAAC,yBAAyB;IAC7C,iBAAiB,EAAE,yBAAyB;IAC5C,qBAAqB,EAAE,EAAE,GAAG,EAAE,wBAAwB,EAAE,GAAG,cAAc,EAAE;CAC5E,CAAC,CACH,CAAA;AAED,iFAAiF;AAEjF;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,MAAM,gCAAgC,GAAG,YAAY,CAC1D,OAAO,EACP,iBAAiB,CAAC;IAChB,MAAM,EAAE,KAAK;IACb,YAAY,EAAE,GAAG,EAAE,CAAC,yBAAyB;IAC7C,kBAAkB,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,CAAC;IAC3D,qBAAqB,EAAE,EAAE,GAAG,EAAE,6BAA6B,EAAE,GAAG,cAAc,EAAE;CACjF,CAAC,CACH,CAAA;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,YAAY,CAChD,OAAO,EACP,iBAAiB,CAAC;IAChB,MAAM,EAAE,MAAM;IACd,YAAY,EAAE,GAAG,EAAE,CAAC,oBAAoB;IACxC,iBAAiB,EAAE,oBAAoB;IACvC,qBAAqB,EAAE,EAAE,GAAG,EAAE,gBAAgB,EAAE,GAAG,cAAc,EAAE;CACpE,CAAC,CACH,CAAA;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,YAAY,CACnD,OAAO,EACP,iBAAiB,CAAC;IAChB,MAAM,EAAE,KAAK;IACb,uBAAuB,EAAE,cAAc,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAC1F,YAAY,EAAE,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,iBAAiB,KAAK,IAAI,IAAI,WAAW;IAC5E,kBAAkB,EAAE,CAAC,CAAC,MAAM,CAAC;QAC3B,IAAI,EAAE,wBAAwB;QAC9B,GAAG,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC;KAChF,CAAC;IACF,qBAAqB,EAAE,EAAE,GAAG,EAAE,oBAAoB,EAAE,GAAG,cAAc,EAAE;CACxE,CAAC,CACH,CAAA;AAED,qFAAqF;AACrF,MAAM,CAAC,MAAM,8BAA8B,GAAG,YAAY,CACxD,OAAO,EACP,iBAAiB,CAAC;IAChB,MAAM,EAAE,KAAK;IACb,uBAAuB,EAAE,WAAW;IACpC,YAAY,EAAE,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,2BAA2B,KAAK,EAAE;IAC/D,qBAAqB,EAAE,EAAE,GAAG,EAAE,wBAAwB,EAAE,GAAG,cAAc,EAAE;CAC5E,CAAC,CACH,CAAA;AAED,gFAAgF;AAEhF;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,uCAAuC,GAAG,YAAY,CACjE,OAAO,EACP,iBAAiB,CAAC;IAChB,MAAM,EAAE,MAAM;IACd,YAAY,EAAE,GAAG,EAAE,CAAC,uCAAuC;IAC3D,iBAAiB,EAAE,qCAAqC;IACxD,qBAAqB,EAAE,EAAE,GAAG,EAAE,qCAAqC,EAAE,GAAG,cAAc,EAAE;CACzF,CAAC,CACH,CAAA;AAED;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,gCAAgC,GAAG,YAAY,CAC1D,OAAO,EACP,iBAAiB,CAAC;IAChB,MAAM,EAAE,MAAM;IACd,YAAY,EAAE,GAAG,EAAE,CAAC,kCAAkC;IACtD,iBAAiB,EAAE,8BAA8B;IACjD,qBAAqB,EAAE,EAAE,GAAG,EAAE,qCAAqC,EAAE,GAAG,cAAc,EAAE;CACzF,CAAC,CACH,CAAA;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,MAAM,wCAAwC,GAAG,YAAY,CAClE,OAAO,EACP,iBAAiB,CAAC;IAChB,MAAM,EAAE,KAAK;IACb,YAAY,EAAE,GAAG,EAAE,CAAC,kCAAkC;IACtD,qBAAqB,EAAE,EAAE,GAAG,EAAE,kCAAkC,EAAE,GAAG,cAAc,EAAE;CACtF,CAAC,CACH,CAAA;AAED,gFAAgF;AAEhF;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,YAAY,CACrD,OAAO,EACP,iBAAiB,CAAC;IAChB,MAAM,EAAE,OAAO;IACf,uBAAuB,EAAE,eAAe;IACxC,YAAY,EAAE,CAAC,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC,oBAAoB,SAAS,EAAE;IAChE,iBAAiB,EAAE,yBAAyB;IAC5C,qBAAqB,EAAE,EAAE,GAAG,EAAE,mBAAmB,EAAE,GAAG,cAAc,EAAE;CACvE,CAAC,CACH,CAAA;AAED,gFAAgF;AAEhF;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAG,YAAY,CACvD,OAAO,EACP,iBAAiB,CAAC;IAChB,MAAM,EAAE,KAAK;IACb,YAAY,EAAE,GAAG,EAAE,CAAC,gBAAgB;IACpC,qBAAqB,EAAE,EAAE,GAAG,EAAE,0BAA0B,EAAE,GAAG,cAAc,EAAE;CAC9E,CAAC,CACH,CAAA;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,8BAA8B,GAAG,YAAY,CACxD,OAAO,EACP,iBAAiB,CAAC;IAChB,MAAM,EAAE,KAAK;IACb,YAAY,EAAE,GAAG,EAAE,CAAC,wBAAwB;IAC5C,qBAAqB,EAAE,EAAE,GAAG,EAAE,6BAA6B,EAAE,GAAG,cAAc,EAAE;CACjF,CAAC,CACH,CAAA;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,8BAA8B,GAAG,YAAY,CACxD,OAAO,EACP,iBAAiB,CAAC;IAChB,MAAM,EAAE,KAAK;IACb,YAAY,EAAE,GAAG,EAAE,CAAC,uBAAuB;IAC3C,qBAAqB,EAAE,EAAE,GAAG,EAAE,0BAA0B,EAAE,GAAG,cAAc,EAAE;CAC9E,CAAC,CACH,CAAA;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,MAAM,8BAA8B,GAAG,YAAY,CACxD,OAAO,EACP,iBAAiB,CAAC;IAChB,MAAM,EAAE,KAAK;IACb,YAAY,EAAE,GAAG,EAAE,CAAC,uBAAuB;IAC3C,qBAAqB,EAAE,EAAE,GAAG,EAAE,2BAA2B,EAAE,GAAG,cAAc,EAAE;CAC/E,CAAC,CACH,CAAA;AAED,iFAAiF;AAEjF;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,iCAAiC,GAAG,YAAY,CAC3D,OAAO,EACP,iBAAiB,CAAC;IAChB,MAAM,EAAE,KAAK;IACb,YAAY,EAAE,GAAG,EAAE,CAAC,2BAA2B;IAC/C,qBAAqB,EAAE,EAAE,GAAG,EAAE,oCAAoC,EAAE,GAAG,cAAc,EAAE;CACxF,CAAC,CACH,CAAA;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,oCAAoC,GAAG,YAAY,CAC9D,OAAO,EACP,iBAAiB,CAAC;IAChB,MAAM,EAAE,OAAO;IACf,YAAY,EAAE,GAAG,EAAE,CAAC,2BAA2B;IAC/C,iBAAiB,EAAE,kCAAkC;IACrD,qBAAqB,EAAE,EAAE,GAAG,EAAE,oCAAoC,EAAE,GAAG,cAAc,EAAE;CACxF,CAAC,CACH,CAAA"}