@celestea/studio 2.7.1

package/dist/handlers/index.js

@@ -0,0 +1,85 @@
+/**
+ * Handler registry — the ONLY place that knows every endpoint group.
+ *
+ * Each `registerXxx` returns the contract ids it bound, and `app.ts` asserts
+ * the union equals the frozen 47. A route can therefore never be silently
+ * dropped: adding an endpoint to `contracts/endpoints.json` without a handler
+ * fails at startup with the missing id.
+ *
+ * Module map:
+ *   common.ts        error/body/field helpers shared by every handler
+ *   config-shape.ts  the /api/config body assembled from live stores
+ *   health.ts        GET  /api/health | /api/status | /api/tools
+ *   dialog.ts        GET  /api/events (SSE) | POST /api/turn | /api/cancel | /api/clear
+ *   config.ts        GET+POST /api/config
+ *   sessions.ts      GET+POST /api/sessions | {id}/messages | {id}/activate | {id}/context
+ *   context-shape.ts the context snapshot body + the 20k-per-entry wire guard
+ *   session-move.ts  {id}/rename | {id}/branch | {id}/compact | archive | unarchive | batch-*
+ *   workspaces.ts    /api/workspaces (+rename/delete/batch-delete)
+ *   fs.ts            GET /api/fs/browse | GET /api/fs/list
+ *   exec.ts          G2: POST /api/exec (immediate shell, permission-gated)
+ *   providers.ts     /api/providers (+delete/test/models fetch/default)
+ *   prompts.ts       /api/prompts (+delete/default)
+ *   worker.ts        /api/worker/spawn | send | status
+ *   grants.ts        GET+POST+DELETE /api/sessions/{id}/grants | grants/confirm-token
+ *   questions.ts     W783: GET /api/questions | POST /api/questions/{id}/answer
+ *   usage.ts         W785: GET /api/usage/ledger (the ledger's aggregate view)
+ *   permissions.ts   W9: /api/permissions/presets (+{id}) | /api/sessions/{id}/permission
+ *   session-tools.ts W860: GET+PUT /api/sessions/{id}/tools (the session's disabled list)
+ *   session-model.ts W870: PUT /api/sessions/{id}/model (the session-level model switch)
+ *   plugins.ts       W860: GET /api/plugins (the host startup plugin inventory)
+ *   auth.ts          W767: GET /login | POST /auth/login | GET /auth/check
+ *
+ * W725: the context endpoint (44th) lives in sessions.ts; its shaping is in
+ * context-shape.ts.
+ */
+import { registerAuth } from "./auth.js";
+import { registerConfig } from "./config.js";
+import { registerDialog } from "./dialog.js";
+import { registerExec } from "./exec.js";
+import { registerFs } from "./fs.js";
+import { registerGrants } from "./grants.js";
+import { registerHealth } from "./health.js";
+import { registerPermissions } from "./permissions.js";
+import { registerPlugins } from "./plugins.js";
+import { registerPrompts } from "./prompts.js";
+import { registerProviders } from "./providers.js";
+import { registerQuestions } from "./questions.js";
+import { registerSessionMoves } from "./session-move.js";
+import { registerSessionModel } from "./session-model.js";
+import { registerSessionTools } from "./session-tools.js";
+import { registerSessions } from "./sessions.js";
+import { registerUsage } from "./usage.js";
+import { registerWorker } from "./worker.js";
+import { registerWorkspaces } from "./workspaces.js";
+export function registerHandlers(app, deps, table) {
+    return [
+        ...registerHealth(app, deps, table),
+        ...registerDialog(app, deps, table),
+        ...registerConfig(app, deps, table),
+        ...registerSessions(app, deps, table),
+        ...registerSessionMoves(app, deps, table),
+        ...registerWorkspaces(app, deps, table),
+        ...registerFs(app, deps, table),
+        // G2: immediate execution for the UI (/run, !cmd) — no model in the loop.
+        ...registerExec(app, deps, table),
+        ...registerProviders(app, deps, table),
+        ...registerPrompts(app, deps, table),
+        ...registerWorker(app, deps, table),
+        ...registerGrants(app, deps, table),
+        // W9: permission presets (custom CRUD + a session's chosen preset).
+        ...registerPermissions(app, deps, table),
+        // W783: the user-question answer + pending-list endpoints (47 -> 49).
+        ...registerQuestions(app, deps, table),
+        // W785 (E-P1, capability 3): the usage ledger's aggregate view (49 -> 50).
+        ...registerUsage(app, deps, table),
+        // W767: Studio's OWN login-cookie gate (page + login + nginx auth_request).
+        ...registerAuth(app, deps, table),
+        // W860: session-level tool switches (57 -> 59) + the host plugin inventory (59 -> 60).
+        ...registerSessionTools(app, deps, table),
+        ...registerPlugins(app, deps, table),
+        // W870: the session-scoped model switch (60 -> 61) — the statusline picker's
+        // target; POST /api/config keeps meaning "the global default".
+        registerSessionModel(app, deps, table),
+    ];
+}

package/dist/handlers/permissions.d.ts

@@ -0,0 +1,9 @@
+/**
+ * The six permission endpoints (W9): custom-preset CRUD plus a session's chosen
+ * preset. Storage and resolution live in store/permissions.ts and
+ * runtime/engine-permissions.ts; this module is the HTTP face only.
+ */
+import type { Hono } from "hono";
+import type { RouteTable } from "../routes.js";
+import { type Deps } from "./common.js";
+export declare function registerPermissions(app: Hono, deps: Deps, table: RouteTable): string[];

package/dist/handlers/permissions.js

@@ -0,0 +1,183 @@
+/**
+ * The six permission endpoints (W9): custom-preset CRUD plus a session's chosen
+ * preset. Storage and resolution live in store/permissions.ts and
+ * runtime/engine-permissions.ts; this module is the HTTP face only.
+ */
+import { effectivePermissionOf, permissionDataDir } from "../runtime/engine-permissions.js";
+import { validatePermissionPreset } from "../runtime/engine-grants.js";
+import { BUILTIN_PRESETS, isBuiltinPresetId, maxPermissionId, readPermissionsFile, readSessionPermission, writePermissionsFile, writeSessionPermission, } from "../store/permissions.js";
+import { nowSec } from "../store/grants-service.js";
+import { errText } from "../store/result.js";
+import { failJson, readJsonBody, strField, storeFail } from "./common.js";
+function presetBody(p) {
+    return {
+        id: p.id,
+        label: p.label,
+        network: p.network,
+        workspaceWritable: p.workspaceWritable,
+        toolRootsWritable: p.toolRootsWritable,
+        writeRoots: [...p.writeRoots],
+        allPaths: p.allPaths,
+        unsandboxed: p.unsandboxed,
+        toolDeny: [...p.toolDeny],
+    };
+}
+/** W864: the resolved baseline, as the two session-permission endpoints report it. */
+function effectiveBody(b) {
+    return {
+        network: b.network,
+        workspaceWritable: b.workspaceWritable,
+        toolRootsWritable: b.toolRootsWritable,
+        writeRoots: [...b.writeRoots],
+        allPaths: b.allPaths,
+        unsandboxed: b.unsandboxed,
+        toolDeny: [...b.toolDeny],
+    };
+}
+function registerListPresets(app, deps, table) {
+    const route = table.get("get_permissions_presets");
+    app.on(route.method, route.honoPath, (c) => {
+        const read = readPermissionsFile(permissionDataDir(deps.grants.env));
+        return c.json({
+            ok: true,
+            builtin: BUILTIN_PRESETS.map(presetBody),
+            custom: read.presets.map(presetBody),
+            max: maxPermissionId(deps.grants.env),
+            ...(read.warnings.length === 0 ? {} : { warnings: read.warnings }),
+        });
+    });
+    return route.id;
+}
+function registerCreatePreset(app, deps, table) {
+    const route = table.get("post_permissions_presets");
+    app.on(route.method, route.honoPath, async (c) => {
+        const body = await readJsonBody(c);
+        if (!body.ok)
+            return body.response;
+        const dataDir = permissionDataDir(deps.grants.env);
+        const read = readPermissionsFile(dataDir);
+        const validated = validatePermissionPreset(body.body["preset"], deps.grants.env, read.presets.map((p) => p.id));
+        if (!validated.ok)
+            return failJson(c, validated.conflict === true ? 409 : 422, validated.error);
+        try {
+            writePermissionsFile(dataDir, [...read.presets, validated.preset], nowSec(deps.grants));
+        }
+        catch (e) {
+            return failJson(c, 500, "cannot persist permissions: " + errText(e));
+        }
+        return c.json({ ok: true, preset: presetBody(validated.preset) });
+    });
+    return route.id;
+}
+function registerUpdatePreset(app, deps, table) {
+    const route = table.get("put_permissions_preset");
+    app.on(route.method, route.honoPath, async (c) => {
+        const id = c.req.param("id") ?? "";
+        if (isBuiltinPresetId(id))
+            return failJson(c, 409, "'" + id + "' is a built-in preset");
+        const body = await readJsonBody(c);
+        if (!body.ok)
+            return body.response;
+        const dataDir = permissionDataDir(deps.grants.env);
+        const read = readPermissionsFile(dataDir);
+        if (!read.presets.some((p) => p.id === id))
+            return failJson(c, 404, "no custom preset '" + id + "'");
+        const validated = validatePermissionPreset(body.body["preset"], deps.grants.env, []);
+        if (!validated.ok)
+            return failJson(c, 422, validated.error);
+        if (validated.preset.id !== id)
+            return failJson(c, 422, "preset id must not change (" + id + ")");
+        const next = read.presets.map((p) => (p.id === id ? validated.preset : p));
+        try {
+            writePermissionsFile(dataDir, next, nowSec(deps.grants));
+        }
+        catch (e) {
+            return failJson(c, 500, "cannot persist permissions: " + errText(e));
+        }
+        return c.json({ ok: true, preset: presetBody(validated.preset) });
+    });
+    return route.id;
+}
+function registerDeletePreset(app, deps, table) {
+    const route = table.get("delete_permissions_preset");
+    app.on(route.method, route.honoPath, (c) => {
+        const id = c.req.param("id") ?? "";
+        if (isBuiltinPresetId(id))
+            return failJson(c, 409, "'" + id + "' is a built-in preset");
+        const dataDir = permissionDataDir(deps.grants.env);
+        const read = readPermissionsFile(dataDir);
+        if (!read.presets.some((p) => p.id === id))
+            return failJson(c, 404, "no custom preset '" + id + "'");
+        try {
+            writePermissionsFile(dataDir, read.presets.filter((p) => p.id !== id), nowSec(deps.grants));
+        }
+        catch (e) {
+            return failJson(c, 500, "cannot persist permissions: " + errText(e));
+        }
+        return c.json({ ok: true, deleted: id });
+    });
+    return route.id;
+}
+function registerGetSessionPermission(app, deps, table) {
+    const route = table.get("get_session_permission");
+    app.on(route.method, route.honoPath, (c) => {
+        const resolved = deps.sessions.require(c.req.param("id") ?? "");
+        if (!resolved.ok)
+            return storeFail(c, resolved);
+        const read = readSessionPermission(resolved.value.dir, resolved.value.id);
+        const baseline = effectivePermissionOf(resolved.value.dir, resolved.value.id, deps.grants.env);
+        const warnings = [
+            ...(read.error === undefined ? [] : [read.error]),
+            ...baseline.warnings,
+        ];
+        return c.json({
+            ok: true,
+            session: resolved.value.id,
+            preset: read.preset ?? baseline.preset,
+            effective: effectiveBody(baseline),
+            ...(warnings.length === 0 ? {} : { warnings }),
+        });
+    });
+    return route.id;
+}
+function registerPutSessionPermission(app, deps, table) {
+    const route = table.get("put_session_permission");
+    app.on(route.method, route.honoPath, async (c) => {
+        const resolved = deps.sessions.require(c.req.param("id") ?? "");
+        if (!resolved.ok)
+            return storeFail(c, resolved);
+        const body = await readJsonBody(c);
+        if (!body.ok)
+            return body.response;
+        const preset = strField(c, body.body, "preset");
+        if (!preset.ok)
+            return preset.response;
+        if (preset.value === undefined || preset.value === "")
+            return failJson(c, 422, "field 'preset' is required");
+        const read = readPermissionsFile(permissionDataDir(deps.grants.env));
+        if (!isBuiltinPresetId(preset.value) && !read.presets.some((p) => p.id === preset.value)) {
+            return failJson(c, 422, "unknown preset '" + preset.value + "'");
+        }
+        try {
+            writeSessionPermission(resolved.value.dir, resolved.value.id, preset.value, nowSec(deps.grants));
+        }
+        catch (e) {
+            return failJson(c, 500, "cannot persist permission: " + errText(e));
+        }
+        // W9: recompose the session at the next boundary (same hook grants use).
+        deps.runtime.invalidateSession?.(resolved.value.id);
+        const baseline = effectivePermissionOf(resolved.value.dir, resolved.value.id, deps.grants.env);
+        return c.json({ ok: true, preset: preset.value, effective: effectiveBody(baseline) });
+    });
+    return route.id;
+}
+export function registerPermissions(app, deps, table) {
+    return [
+        registerListPresets(app, deps, table),
+        registerCreatePreset(app, deps, table),
+        registerUpdatePreset(app, deps, table),
+        registerDeletePreset(app, deps, table),
+        registerGetSessionPermission(app, deps, table),
+        registerPutSessionPermission(app, deps, table),
+    ];
+}

package/dist/handlers/plugins.d.ts

@@ -0,0 +1,18 @@
+/**
+ * W860: the host plugin inventory — `GET /api/plugins`.
+ *
+ * The names are NOT a constant transcribed here: `composeStudio` records what it
+ * actually mounted (`StudioServices.hostPluginNames`, built with `pluginNames`
+ * over the very `storePlugins` / `hostPlugins` arrays it mounts), and this
+ * handler reads that record. Adding a plugin to `plugins.ts` therefore shows up
+ * here automatically — there is no second list to forget.
+ *
+ * Honest boundary (also stated in the contract note): this covers the HOST
+ * startup layer only — the store plugins (workspaces, sessions, session-ops,
+ * providers, prompts) and the host singletons (bus, runtime, settings).
+ * Plugins the ENGINE mounts while composing a session are not listed.
+ */
+import type { Hono } from "hono";
+import type { RouteTable } from "../routes.js";
+import type { Deps } from "./common.js";
+export declare function registerPlugins(app: Hono, deps: Deps, table: RouteTable): string[];

package/dist/handlers/plugins.js

@@ -0,0 +1,23 @@
+/**
+ * W860: the host plugin inventory — `GET /api/plugins`.
+ *
+ * The names are NOT a constant transcribed here: `composeStudio` records what it
+ * actually mounted (`StudioServices.hostPluginNames`, built with `pluginNames`
+ * over the very `storePlugins` / `hostPlugins` arrays it mounts), and this
+ * handler reads that record. Adding a plugin to `plugins.ts` therefore shows up
+ * here automatically — there is no second list to forget.
+ *
+ * Honest boundary (also stated in the contract note): this covers the HOST
+ * startup layer only — the store plugins (workspaces, sessions, session-ops,
+ * providers, prompts) and the host singletons (bus, runtime, settings).
+ * Plugins the ENGINE mounts while composing a session are not listed.
+ */
+/** One row of the inventory; `hot` is about runtime mounting, not this value. */
+function pluginRows(deps) {
+    return deps.hostPluginNames.map((name) => ({ name, layer: "host", hot: false }));
+}
+export function registerPlugins(app, deps, table) {
+    const route = table.get("get_plugins");
+    app.on(route.method, route.honoPath, (c) => c.json({ ok: true, plugins: pluginRows(deps) }));
+    return [route.id];
+}

package/dist/handlers/prompts.d.ts

@@ -0,0 +1,12 @@
+/**
+ * Prompt registry endpoints — `src/prompts.rs:714-875`.
+ *
+ * Scope resolution: `workspace` absent or blank = global; an unknown workspace
+ * is 404. The three write endpoints share ONE order: 409 guard (nothing is
+ * written) -> persist -> hot apply -> restore the previous file when the apply
+ * fails, so a failed compose can never leave the registry ahead of the engine.
+ */
+import type { Hono } from "hono";
+import type { RouteTable } from "../routes.js";
+import { type Deps } from "./common.js";
+export declare function registerPrompts(app: Hono, deps: Deps, table: RouteTable): string[];

package/dist/handlers/prompts.js

@@ -0,0 +1,120 @@
+/**
+ * Prompt registry endpoints — `src/prompts.rs:714-875`.
+ *
+ * Scope resolution: `workspace` absent or blank = global; an unknown workspace
+ * is 404. The three write endpoints share ONE order: 409 guard (nothing is
+ * written) -> persist -> hot apply -> restore the previous file when the apply
+ * fails, so a failed compose can never leave the registry ahead of the engine.
+ */
+import { EngineError } from "../runtime-adapter.js";
+import { activePromptBinding, assembleSystemPromptFor } from "./config-shape.js";
+import { DEFAULT_SESSION_MODE } from "../store/mode.js";
+import { failJson, readJsonBody, strField, storeFail } from "./common.js";
+function resolveScope(deps, workspace) {
+    const name = (workspace ?? "").trim();
+    if (name === "")
+        return { scope: deps.prompts.scopeGlobal() };
+    const path = deps.workspaces.workspacePath(name);
+    if (path === undefined)
+        return { error: `unknown workspace '${name}'` };
+    return { scope: deps.prompts.scopeWorkspace(name, path) };
+}
+/**
+ * 409 -> persist -> hot apply -> rollback; returns the success body.
+ *
+ * W815-N2: the whole snapshot/mutate/configure/rollback window runs inside the
+ * shared serial queue, so a concurrent write cannot re-snapshot in the middle
+ * and have its success rolled back by an earlier failure.
+ */
+async function hotApply(deps, scope, mutate) {
+    if (deps.runtime.isBusy())
+        return { ok: false, status: 409, error: "turn in progress; prompt applies between turns" };
+    return deps.applyQueue.run(async () => {
+        const snapshot = deps.prompts.snapshot(scope);
+        const res = mutate();
+        if (!res.ok)
+            return { ok: false, status: res.status, error: res.error };
+        try {
+            // W729: a prompt hot-apply primes the BASE generation, so it stays on the
+            // DEFAULT mode and can never inherit the active session's mode variant.
+            await deps.runtime.configure({ system_prompt: assembleSystemPromptFor(deps, null, DEFAULT_SESSION_MODE) });
+        }
+        catch (e) {
+            // W815-1: a null snapshot means the scope file did not exist before this
+            // mutate; restoring must therefore REMOVE the file (PromptsStore.restore).
+            deps.prompts.restore(scope, snapshot);
+            return { ok: false, status: 500, error: `compose failed: ${e instanceof EngineError ? e.message : String(e)}` };
+        }
+        return { ok: true, body: { ok: true, ...res.value } };
+    });
+}
+function registerList(app, deps, table) {
+    const route = table.get("get_prompts");
+    app.on(route.method, route.honoPath, (c) => {
+        const resolved = resolveScope(deps, c.req.query("workspace"));
+        if (resolved.scope === undefined)
+            return failJson(c, 404, resolved.error ?? "unknown workspace");
+        return c.json(deps.prompts.list(resolved.scope, activePromptBinding(deps)));
+    });
+    return route.id;
+}
+function registerUpsert(app, deps, table) {
+    const route = table.get("post_prompts");
+    app.on(route.method, route.honoPath, async (c) => {
+        const read = await readJsonBody(c);
+        if (!read.ok)
+            return read.response;
+        const workspace = strField(c, read.body, "workspace");
+        const id = strField(c, read.body, "id");
+        const name = strField(c, read.body, "name");
+        for (const f of [workspace, id, name])
+            if (!f.ok)
+                return f.response;
+        const resolved = resolveScope(deps, workspace.ok ? workspace.value : undefined);
+        if (resolved.scope === undefined)
+            return failJson(c, 404, resolved.error ?? "unknown workspace");
+        const overrides = read.body["section_overrides"];
+        // W815-6: a PRESENT but wrongly-typed field is a 400, never a silent
+        // "absent" that would replace the stored overrides with an empty map. Only
+        // absent/null falls back to the store's default.
+        if (overrides !== undefined && overrides !== null && !isStringMap(overrides)) {
+            return failJson(c, 400, "section_overrides must be an object of string templates");
+        }
+        const out = await hotApply(deps, resolved.scope, () => deps.prompts.upsert(resolved.scope, {
+            id: (id.ok ? id.value : "") ?? "",
+            name: (name.ok ? name.value : "") ?? "",
+            section_overrides: isStringMap(overrides) ? overrides : undefined,
+            is_default: typeof read.body["is_default"] === "boolean" ? read.body["is_default"] : undefined,
+        }));
+        if (!out.ok)
+            return failJson(c, out.status, out.error);
+        return c.json(out.body);
+    });
+    return route.id;
+}
+function isStringMap(v) {
+    return typeof v === "object" && v !== null && !Array.isArray(v) && Object.values(v).every((x) => typeof x === "string");
+}
+function registerScopedWrite(app, deps, table, id) {
+    const route = table.get(id);
+    app.on(route.method, route.honoPath, async (c) => {
+        const read = await readJsonBody(c, false);
+        if (!read.ok)
+            return read.response;
+        const workspace = strField(c, read.body, "workspace");
+        if (!workspace.ok)
+            return workspace.response;
+        const resolved = resolveScope(deps, workspace.value);
+        if (resolved.scope === undefined)
+            return failJson(c, 404, resolved.error ?? "unknown workspace");
+        const promptId = c.req.param("id") ?? "";
+        const out = await hotApply(deps, resolved.scope, () => id === "post_prompts_delete" ? deps.prompts.remove(resolved.scope, promptId) : deps.prompts.setDefault(resolved.scope, promptId));
+        if (!out.ok)
+            return failJson(c, out.status, out.error);
+        return c.json(out.body);
+    });
+    return route.id;
+}
+export function registerPrompts(app, deps, table) {
+    return [registerList(app, deps, table), registerUpsert(app, deps, table), registerScopedWrite(app, deps, table, "post_prompts_delete"), registerScopedWrite(app, deps, table, "post_prompts_default")];
+}

package/dist/handlers/providers.d.ts

@@ -0,0 +1,12 @@
+/**
+ * Provider endpoints — `src/providers.rs:673-797`.
+ *
+ * Every response is a `public_view`: the `api_key` KEY does not exist in the
+ * shape at all. `/api/providers/test` accepts a full inline overlay that is
+ * never persisted; `/models/fetch` resolves the row from the store and may
+ * borrow the engine's own key for a same-origin keyless provider.
+ */
+import type { Hono } from "hono";
+import type { RouteTable } from "../routes.js";
+import { type Deps } from "./common.js";
+export declare function registerProviders(app: Hono, deps: Deps, table: RouteTable): string[];

package/dist/handlers/providers.js

@@ -0,0 +1,178 @@
+/**
+ * Provider endpoints — `src/providers.rs:673-797`.
+ *
+ * Every response is a `public_view`: the `api_key` KEY does not exist in the
+ * shape at all. `/api/providers/test` accepts a full inline overlay that is
+ * never persisted; `/models/fetch` resolves the row from the store and may
+ * borrow the engine's own key for a same-origin keyless provider.
+ */
+import { EngineError } from "../runtime-adapter.js";
+import { probeModels, testProvider } from "../store/provider-probe.js";
+import { REQUEST_FORMATS } from "../store/providers.js";
+import { isHttpUrl } from "../store/validate.js";
+import { baseUrlOf } from "./config-shape.js";
+// W742 §1: the same "background work in flight" guard `POST /api/config` uses.
+import { workersInFlight } from "./config.js";
+import { failJson, readJsonBody, strField, storeFail } from "./common.js";
+function probeOptions(deps) {
+    return { engineBaseUrl: baseUrlOf(deps), engineKey: process.env[deps.config.apiKeyEnv] ?? null };
+}
+/** Validate a candidate the way the retired backend validated `ProviderReq` before probing. */
+function candidateError(candidate) {
+    if (candidate.base_url.trim() === "")
+        return "base_url is required";
+    if (!isHttpUrl(candidate.base_url))
+        return "base_url must be an http:// or https:// URL";
+    if (!REQUEST_FORMATS.includes(candidate.request_format)) {
+        return `invalid request_format '${candidate.request_format}': expected chat_completions | responses | anthropic_messages`;
+    }
+    return null;
+}
+function asCandidate(body, stored) {
+    const fmt = typeof body["request_format"] === "string" ? body["request_format"] : (stored?.request_format ?? "chat_completions");
+    return {
+        id: stored?.id ?? "__inline__",
+        base_url: typeof body["base_url"] === "string" ? body["base_url"] : (stored?.base_url ?? ""),
+        request_format: fmt,
+        api_key: typeof body["api_key"] === "string" ? body["api_key"] : (stored?.api_key ?? null),
+    };
+}
+function registerList(app, deps, table) {
+    const route = table.get("get_providers");
+    app.on(route.method, route.honoPath, (c) => c.json(deps.providers.response()));
+    return route.id;
+}
+function registerUpsert(app, deps, table) {
+    const route = table.get("post_providers");
+    app.on(route.method, route.honoPath, async (c) => {
+        const read = await readJsonBody(c);
+        if (!read.ok)
+            return read.response;
+        const body = read.body;
+        const models = body["models"];
+        // W815-7: a PRESENT but wrongly-typed `models` is a 400. It used to fall
+        // through as `undefined`, which the store reads as "absent" and therefore
+        // CLEARS the list — only an absent/null field may clear (docs/pitfalls P1b).
+        if (models !== undefined && models !== null && !Array.isArray(models)) {
+            return failJson(c, 400, "models must be an array");
+        }
+        const res = deps.providers.upsert({
+            id: typeof body["id"] === "string" ? body["id"] : undefined,
+            name: typeof body["name"] === "string" ? body["name"] : undefined,
+            note: typeof body["note"] === "string" ? body["note"] : undefined,
+            base_url: typeof body["base_url"] === "string" ? body["base_url"] : undefined,
+            request_format: typeof body["request_format"] === "string" ? body["request_format"] : undefined,
+            api_key: typeof body["api_key"] === "string" ? body["api_key"] : null,
+            models: Array.isArray(models) ? models : undefined,
+        });
+        if (!res.ok)
+            return storeFail(c, res);
+        return c.json(res.value);
+    });
+    return route.id;
+}
+function registerDelete(app, deps, table) {
+    const route = table.get("post_provider_delete");
+    app.on(route.method, route.honoPath, (c) => {
+        const res = deps.providers.remove(c.req.param("id") ?? "");
+        if (!res.ok)
+            return storeFail(c, res);
+        return c.json({ ok: true });
+    });
+    return route.id;
+}
+function registerTest(app, deps, table) {
+    const route = table.get("post_provider_test");
+    app.on(route.method, route.honoPath, async (c) => {
+        const read = await readJsonBody(c, false);
+        if (!read.ok)
+            return read.response;
+        const id = strField(c, read.body, "id");
+        if (!id.ok)
+            return id.response;
+        const stored = id.value === undefined ? undefined : deps.providers.find(id.value);
+        const candidate = asCandidate(read.body, stored);
+        const bad = candidateError(candidate);
+        if (bad !== null)
+            return failJson(c, 400, bad);
+        const out = await testProvider(candidate, probeOptions(deps));
+        if (!out.ok)
+            return c.json({ ok: false, error: out.error });
+        return c.json({ ok: true, latency_ms: out.latency_ms, model_count: out.model_count });
+    });
+    return route.id;
+}
+function registerModelsFetch(app, deps, table) {
+    const route = table.get("post_provider_models_fetch");
+    app.on(route.method, route.honoPath, async (c) => {
+        const id = c.req.param("id") ?? "";
+        const stored = deps.providers.find(id);
+        if (stored === undefined)
+            return failJson(c, 404, `unknown provider '${id}'`);
+        const out = await probeModels({ id: stored.id, base_url: stored.base_url, request_format: stored.request_format, api_key: stored.api_key }, probeOptions(deps));
+        if (!out.ok)
+            return c.json({ ok: false, error: out.error });
+        return c.json({ ok: true, models: out.models });
+    });
+    return route.id;
+}
+/**
+ * POST /api/providers/default — make (provider, model) the default pair.
+ *
+ * W750: `provider_id` is the OPTIONAL disambiguator. Model ids are not unique
+ * across providers (production: `deepseek-flash` is listed by both the gateway
+ * and 「基元」), so "model id only" cannot express "switch to THAT provider" —
+ * the plain `find` below would keep picking the first provider that happens to
+ * list the id. When `provider_id` is given the model must be one of that
+ * provider's models (otherwise nothing is applied: 400/404, no partial write);
+ * when it is absent the historical first-lister behaviour is unchanged.
+ */
+function registerDefault(app, deps, table) {
+    const route = table.get("post_provider_default");
+    app.on(route.method, route.honoPath, async (c) => {
+        const read = await readJsonBody(c);
+        if (!read.ok)
+            return read.response;
+        const model = strField(c, read.body, "model");
+        if (!model.ok)
+            return model.response;
+        const providerId = strField(c, read.body, "provider_id");
+        if (!providerId.ok)
+            return providerId.response;
+        const wanted = (model.value ?? "").trim();
+        if (wanted === "")
+            return failJson(c, 400, "model must not be empty");
+        if (deps.runtime.isBusy())
+            return failJson(c, 409, "a turn is running; provider default applies between turns");
+        if (workersInFlight(deps.runtime))
+            return failJson(c, 409, "a worker is running; provider default applies between turns");
+        const askedProvider = (providerId.value ?? "").trim();
+        let owner;
+        if (askedProvider !== "") {
+            owner = deps.providers.rows().find((p) => p.id === askedProvider);
+            if (owner === undefined)
+                return failJson(c, 404, `unknown provider '${askedProvider}'`);
+            if (!owner.models.some((m) => m.id === wanted)) {
+                return failJson(c, 400, `provider '${askedProvider}' does not list model '${wanted}'`);
+            }
+        }
+        else {
+            owner = deps.providers.rows().find((p) => p.models.some((m) => m.id === wanted));
+        }
+        const patch = owner !== undefined && owner.request_format === "chat_completions" && owner.base_url !== "" ? { model: wanted, base_url: owner.base_url } : { model: wanted };
+        try {
+            await deps.runtime.configure(patch);
+        }
+        catch (e) {
+            return failJson(c, 500, e instanceof EngineError ? e.message : String(e));
+        }
+        const saved = deps.providers.setDefaultModel(wanted);
+        if (!saved.ok)
+            return storeFail(c, saved);
+        return c.json(deps.providers.response());
+    });
+    return route.id;
+}
+export function registerProviders(app, deps, table) {
+    return [registerList(app, deps, table), registerUpsert(app, deps, table), registerDelete(app, deps, table), registerTest(app, deps, table), registerModelsFetch(app, deps, table), registerDefault(app, deps, table)];
+}