@code-partner/codepipe-hub 0.14.1-dev.423.ga49d1f61 → 0.14.1-dev.424.ge3c8cc77

package/hub/dist/embedded.js

@@ -457,7 +457,7 @@ var PLATFORM_VERSION;
 var init_version_generated = __esm({
   "../packages/shared/dist/version.generated.js"() {
     "use strict";
-    PLATFORM_VERSION = "0.14.1-dev.423.ga49d1f61";
+    PLATFORM_VERSION = "0.14.1-dev.424.ge3c8cc77";
   }
 });
 

package/hub/dist/index.js

@@ -13,7 +13,7 @@ var PLATFORM_VERSION;
 var init_version_generated = __esm({
   "../packages/shared/dist/version.generated.js"() {
     "use strict";
-    PLATFORM_VERSION = "0.14.1-dev.423.ga49d1f61";
+    PLATFORM_VERSION = "0.14.1-dev.424.ge3c8cc77";
   }
 });
 
@@ -8675,7 +8675,10 @@ var init_route_definition = __esm({
       node: ["/node/v1"],
       local: ["/local"],
       mcp: ["/mcp"],
-      bootstrap: ["/auth", "/bootstrap"],
+      // `/cli` is the CLI's own bootstrap: the connection request it opens, the
+      // page and the email link a person confirms it on (DEV-927 settled it here
+      // rather than moving a path the CLI and a sent email already hold).
+      bootstrap: ["/auth", "/bootstrap", "/cli"],
       operational: ["/healthz", "/readyz"],
       // Static serves the browser bundle from the root and the install script from
       // its documented path (ADR-0060 §5), so it has no single prefix to check.
@@ -8697,7 +8700,8 @@ var init_route_definition = __esm({
       "/api/tasks",
       "/api/projects",
       "/api/admin",
-      "/api/notifications"
+      "/api/notifications",
+      "/bug-report"
     ];
     PUBLIC_MUTATION_ALLOWLIST = [
       "auth.login",
@@ -8705,11 +8709,8 @@ var init_route_definition = __esm({
       "auth.loginPassword",
       "auth.logout",
       "auth.register",
-      "auth.setPassword",
       "bootstrap.request",
-      "bootstrap.confirm",
       "bootstrap.authorizeEmail",
-      "bootstrap.authorizeConfirm",
       // DEV-927: a node registers with a registration token in the body — the
       // token IS the credential, and there is no node identity yet to bear it.
       "node.sandbox.register",
@@ -8720,8 +8721,8 @@ var init_route_definition = __esm({
 });
 
 // src/http/route-registry.ts
-function installRouteGuard(app, mode, log) {
-  const registry = new RouteRegistry(mode, log);
+function installRouteGuard(app, mode, log, legacy = []) {
+  const registry = new RouteRegistry(mode, log, legacy);
   app.addHook("onRoute", (route) => registry.inspect(route));
   return registry;
 }
@@ -8742,15 +8743,18 @@ var init_route_registry = __esm({
     init_route_definition();
     META_KEY = "codepipeRoute";
     RouteRegistry = class {
-      constructor(mode, log = { warn: (message) => console.warn(message) }) {
+      constructor(mode, log = { warn: (message) => console.warn(message) }, legacy = []) {
         this.mode = mode;
         this.log = log;
+        this.legacyAllowed = new Set(legacy);
       }
       routes = /* @__PURE__ */ new Map();
       paths = /* @__PURE__ */ new Set();
       operationIds = /* @__PURE__ */ new Set();
       unclassified = 0;
       invalid = 0;
+      legacyAllowed;
+      legacySeen = /* @__PURE__ */ new Set();
       /** Every route registered with metadata, in registration order. */
       list() {
         return [...this.routes.values()];
@@ -8768,6 +8772,12 @@ var init_route_registry = __esm({
       unclassifiedCount() {
         return this.unclassified;
       }
+      /** The same registrations by name (`METHOD /path`), so a test can hold the
+       *  legacy list to exactly what the process still serves: an entry nobody
+       *  registers any more is a stale allowance, and it fails there. */
+      unclassifiedRoutes() {
+        return [...this.legacySeen];
+      }
       /** Registrations that had metadata and broke a rule. Counted separately from
        *  the unclassified ones: "not migrated yet" and "migrated wrongly" are
        *  different problems, and a violation that lands in neither count is a
@@ -8787,12 +8797,14 @@ var init_route_registry = __esm({
         if (methods.length === 0) return;
         this.paths.add(route.url);
         if (!meta) {
-          this.unclassified += 1;
-          if (this.mode === "enforce") {
+          const tolerated = methods.every((method) => this.legacyAllowed.has(`${method} ${route.url}`));
+          if (this.mode === "enforce" && !tolerated) {
             throw new Error(
-              `route registry: ${methods.join("/")} ${route.url} registered without metadata \u2014 every route declares its surface, operationId and policy (ADR-0060 \xA73)`
+              `route registry: ${methods.join("/")} ${route.url} registered without metadata \u2014 every route declares its surface, operationId and policy (ADR-0060 \xA73); the old roots are closed since the cutover (DEV-927)`
             );
           }
+          this.unclassified += 1;
+          for (const method of methods) this.legacySeen.add(`${method} ${route.url}`);
           return;
         }
         const violations = methods.flatMap(
@@ -28906,9 +28918,7 @@ var DASHBOARD_ROUTES = [
 var CONSOLE_ROUTES = [/^\/$/];
 var DECLARED_RESERVED_ROOTS = [
   ...Object.values(SURFACE_PREFIXES).flat(),
-  ...RETIRED_ROOTS,
-  "/cli",
-  "/ws"
+  ...RETIRED_ROOTS
 ];
 function isBrowserRoute(app, path) {
   const clean = path.split("?")[0].split("#")[0];
@@ -29072,6 +29082,121 @@ async function registerSpaHosts(app, opts) {
 // src/server.ts
 init_route_registry();
 
+// src/http/legacy-routes.ts
+var STATIC_PLUGIN_ROUTES = ["GET /*"];
+var LEGACY_ROUTES = [
+  "DELETE /api/admin/farms/:farmId",
+  "DELETE /api/admin/runners/:runnerId",
+  "DELETE /api/admin/sandboxes/:sandboxId",
+  "DELETE /projects/:projectId/secrets/:name",
+  "DELETE /runner/:runnerId",
+  "DELETE /runner/reg-token",
+  "DELETE /sandbox/:sandboxId",
+  "DELETE /sandbox/reg-token",
+  "GET /admin/pause",
+  "GET /api/admin/farms",
+  "GET /api/admin/logs",
+  "GET /api/admin/presence",
+  "GET /api/admin/projects",
+  "GET /api/admin/registrations",
+  "GET /api/admin/runners",
+  "GET /api/admin/server",
+  "GET /api/admin/settings",
+  "GET /api/admin/stats",
+  "GET /api/admin/users",
+  "GET /api/notifications/settings",
+  "GET /api/projects/:projectId/tasks/:taskKey/plan-review",
+  "GET /bug-report",
+  "GET /projects/:projectId/actions",
+  "GET /projects/:projectId/adr-backfill",
+  "GET /projects/:projectId/clusters/:anchorKey/journal",
+  "GET /projects/:projectId/config-proposals/:proposalId/agent-activity/stream",
+  "GET /projects/:projectId/context-file",
+  "GET /projects/:projectId/drafts/:draftId/agent-activity/stream",
+  "GET /projects/:projectId/model/drift",
+  "GET /projects/:projectId/model/search",
+  "GET /projects/:projectId/pause",
+  "GET /projects/:projectId/prompts",
+  "GET /projects/:projectId/prompts/:role",
+  "GET /projects/:projectId/review-metrics",
+  "GET /projects/:projectId/runs",
+  "GET /projects/:projectId/runs/:runId/stream",
+  "GET /projects/:projectId/tasks/:taskKey/actions",
+  "GET /projects/:projectId/tasks/:taskKey/agent-activity/stream",
+  "GET /projects/:projectId/tasks/:taskKey/external-review/draft",
+  "GET /projects/:projectId/tasks/:taskKey/review-rounds",
+  "GET /projects/:projectId/tracker-status",
+  "GET /projects/:projectId/tracker/fields",
+  "GET /runner/reg-token",
+  "GET /runners",
+  "GET /sandbox/reg-token",
+  "POST /admin/pause",
+  "POST /api/admin/farms/:farmId/assign",
+  "POST /api/admin/farms/:farmId/unassign",
+  "POST /api/admin/registrations/:id/approve",
+  "POST /api/admin/registrations/:id/reject",
+  "POST /api/admin/runners/:runnerId/owner",
+  "POST /api/admin/users",
+  "POST /api/admin/users/:email/activate",
+  "POST /api/admin/users/:email/block",
+  "POST /api/projects/:projectId/tasks/:taskKey/develop",
+  "POST /api/projects/:projectId/tasks/:taskKey/observer-answer",
+  "POST /api/projects/:projectId/tasks/:taskKey/plan-review",
+  "POST /api/projects/:projectId/tasks/:taskKey/stage",
+  "POST /api/projects/:projectId/tasks/:taskKey/workflow-route",
+  "POST /bug-report",
+  "POST /projects/:projectId/actions/:actionId/run",
+  "POST /projects/:projectId/adr-backfill/discard",
+  "POST /projects/:projectId/adr-backfill/promote",
+  "POST /projects/:projectId/check-readiness",
+  "POST /projects/:projectId/clusters/:anchorKey/reject",
+  "POST /projects/:projectId/creds",
+  "POST /projects/:projectId/detach-from-farm",
+  "POST /projects/:projectId/gh-runner/connect",
+  "POST /projects/:projectId/gh-runner/disconnect",
+  "POST /projects/:projectId/model-bootstrap",
+  "POST /projects/:projectId/move-to-farm",
+  "POST /projects/:projectId/pause",
+  "POST /projects/:projectId/refresh-context-status",
+  "POST /projects/:projectId/retry-init",
+  "POST /projects/:projectId/secrets",
+  "POST /projects/:projectId/sync-config",
+  "POST /projects/:projectId/sync-context",
+  "POST /projects/:projectId/tasks/:taskKey/actions/:actionId/run",
+  "POST /projects/:projectId/tasks/:taskKey/approve",
+  "POST /projects/:projectId/tasks/:taskKey/build-flag",
+  "POST /projects/:projectId/tasks/:taskKey/cancel",
+  "POST /projects/:projectId/tasks/:taskKey/comment",
+  "POST /projects/:projectId/tasks/:taskKey/external-review/close",
+  "POST /projects/:projectId/tasks/:taskKey/external-review/dismiss",
+  "POST /projects/:projectId/tasks/:taskKey/external-review/publish",
+  "POST /projects/:projectId/tasks/:taskKey/external-review/rerun",
+  "POST /projects/:projectId/tasks/:taskKey/external-review/start",
+  "POST /projects/:projectId/tasks/:taskKey/force-done",
+  "POST /projects/:projectId/tasks/:taskKey/open-pr",
+  "POST /projects/:projectId/tasks/:taskKey/pause",
+  "POST /projects/:projectId/tasks/:taskKey/publish-branch",
+  "POST /projects/:projectId/tasks/:taskKey/reject",
+  "POST /projects/:projectId/tasks/:taskKey/restart",
+  "POST /projects/:projectId/tasks/:taskKey/retry",
+  "POST /projects/:projectId/tasks/:taskKey/to-backlog",
+  "POST /projects/:projectId/tasks/:taskKey/tracker-status",
+  "POST /projects/:projectId/tasks/:taskKey/unarchive",
+  "POST /projects/:projectId/tracker-sync",
+  "POST /runner/reg-token",
+  "POST /sandbox/reg-token",
+  "PUT /api/admin/farms/:farmId/quota",
+  "PUT /api/admin/settings",
+  "PUT /api/notifications/settings",
+  "PUT /projects/:projectId/adr/:file",
+  "PUT /projects/:projectId/prompts/:role",
+  "PUT /projects/:projectId/tasks/:taskKey/branch-name",
+  "PUT /projects/:projectId/tasks/:taskKey/cluster-base",
+  "PUT /projects/:projectId/tasks/:taskKey/commit-summary",
+  "PUT /projects/:projectId/tasks/:taskKey/description",
+  "PUT /projects/:projectId/tasks/:taskKey/solution"
+];
+
 // src/http/browser-security.ts
 init_auth();
 import { createHash as createHash9, randomBytes as randomBytes3 } from "node:crypto";
@@ -38000,6 +38125,7 @@ function clearPasswordAttempts(key) {
 
 // src/routes/auth.ts
 init_users();
+init_route_registry();
 async function authRoutes(app, deps) {
   const { db, config, mailer } = deps;
   const loginByIp = createAbuseThrottle({ windowMs: 15 * 6e4, max: 30 });
@@ -38040,18 +38166,21 @@ async function authRoutes(app, deps) {
   function registerAccountRoutes() {
     app.post(
       "/auth/login",
-      {
-        schema: {
-          body: {
-            type: "object",
-            required: ["email"],
-            properties: {
-              email: { type: "string", minLength: 3, maxLength: 254 },
-              pwa_nonce: { type: "string", minLength: 1, maxLength: 64 }
-            }
+      routeMeta({
+        surface: "bootstrap",
+        operationId: "auth.login",
+        authPolicy: "public",
+        stability: "preview",
+        summary: "Sign in: send a magic link",
+        requestSchema: {
+          type: "object",
+          required: ["email"],
+          properties: {
+            email: { type: "string", minLength: 3, maxLength: 254 },
+            pwa_nonce: { type: "string", minLength: 1, maxLength: 64 }
           }
         }
-      },
+      }),
       async (req, reply) => {
         const email = (req.body.email ?? "").trim().toLowerCase();
         if (loginThrottled(email, req.ip)) {
@@ -38069,18 +38198,21 @@ async function authRoutes(app, deps) {
     );
     app.post(
       "/auth/login-start",
-      {
-        schema: {
-          body: {
-            type: "object",
-            required: ["email"],
-            properties: {
-              email: { type: "string", minLength: 3, maxLength: 254 },
-              pwa_nonce: { type: "string", minLength: 1, maxLength: 64 }
-            }
+      routeMeta({
+        surface: "bootstrap",
+        operationId: "auth.loginStart",
+        authPolicy: "public",
+        stability: "preview",
+        summary: "Start a sign-in, without saying whether the account exists",
+        requestSchema: {
+          type: "object",
+          required: ["email"],
+          properties: {
+            email: { type: "string", minLength: 3, maxLength: 254 },
+            pwa_nonce: { type: "string", minLength: 1, maxLength: 64 }
           }
         }
-      },
+      }),
       async (req, reply) => {
         const email = (req.body.email ?? "").trim().toLowerCase();
         if (loginThrottled(email, req.ip)) {
@@ -38102,18 +38234,21 @@ async function authRoutes(app, deps) {
     );
     app.post(
       "/auth/login-password",
-      {
-        schema: {
-          body: {
-            type: "object",
-            required: ["email", "password"],
-            properties: {
-              email: { type: "string", minLength: 3, maxLength: 254 },
-              password: { type: "string", minLength: 1, maxLength: MAX_PASSWORD_LENGTH }
-            }
+      routeMeta({
+        surface: "bootstrap",
+        operationId: "auth.loginPassword",
+        authPolicy: "public",
+        stability: "preview",
+        summary: "Sign in with a password",
+        requestSchema: {
+          type: "object",
+          required: ["email", "password"],
+          properties: {
+            email: { type: "string", minLength: 3, maxLength: 254 },
+            password: { type: "string", minLength: 1, maxLength: MAX_PASSWORD_LENGTH }
           }
         }
-      },
+      }),
       async (req, reply) => {
         const email = (req.body.email ?? "").trim().toLowerCase();
         const password = req.body.password ?? "";
@@ -38137,15 +38272,18 @@ async function authRoutes(app, deps) {
     );
     app.post(
       "/auth/set-password",
-      {
-        schema: {
-          body: {
-            type: "object",
-            required: ["password"],
-            properties: { password: { type: "string", minLength: 1, maxLength: 512 } }
-          }
+      routeMeta({
+        surface: "bootstrap",
+        operationId: "auth.setPassword",
+        authPolicy: "session",
+        stability: "preview",
+        summary: "Set the signed-in account's password",
+        requestSchema: {
+          type: "object",
+          required: ["password"],
+          properties: { password: { type: "string", minLength: 1, maxLength: 512 } }
         }
-      },
+      }),
       async (req, reply) => {
         const session = await requireSession(db, req, reply);
         if (!session) return reply;
@@ -38164,7 +38302,14 @@ async function authRoutes(app, deps) {
         return reply.send({ status: "ok" });
       }
     );
-    app.get("/auth/verify", async (req, reply) => {
+    app.get("/auth/verify", routeMeta({
+      surface: "bootstrap",
+      operationId: "auth.verify",
+      authPolicy: "public",
+      // A redirect from an email link, not a JSON operation to generate a client for.
+      stability: "internal",
+      summary: "Redeem a magic link"
+    }), async (req, reply) => {
       const wantsHtml = (req.headers.accept ?? "").toLowerCase().includes("text/html");
       const token = (req.query.token ?? "").trim();
       if (!token) {
@@ -38186,7 +38331,14 @@ async function authRoutes(app, deps) {
     });
   }
   function registerSessionRoutes() {
-    app.get("/auth/me", async (req, reply) => {
+    app.get("/auth/me", routeMeta({
+      surface: "bootstrap",
+      operationId: "auth.me",
+      // A cookie, or the single-owner's credential on the local profile.
+      authPolicy: "application_actor",
+      stability: "preview",
+      summary: "Who is signed in"
+    }), async (req, reply) => {
       const session = await readSession(db, req);
       if (!session) return reply.status(401).send({ error: "no_session" });
       const user = await findUser(db, session.email);
@@ -38198,7 +38350,13 @@ async function authRoutes(app, deps) {
         singleOwner
       };
     });
-    app.post("/auth/logout", async (req, reply) => {
+    app.post("/auth/logout", routeMeta({
+      surface: "bootstrap",
+      operationId: "auth.logout",
+      authPolicy: "public",
+      stability: "preview",
+      summary: "Sign out"
+    }), async (req, reply) => {
       const cookie2 = req.cookies[SESSION_COOKIE_NAME];
       if (cookie2) {
         const unsigned = req.unsignCookie(cookie2);
@@ -38209,7 +38367,13 @@ async function authRoutes(app, deps) {
       reply.clearCookie(SESSION_COOKIE_NAME, { path: "/" });
       return { status: "ok" };
     });
-    app.get("/auth/pwa-ready", async (req, reply) => {
+    app.get("/auth/pwa-ready", routeMeta({
+      surface: "bootstrap",
+      operationId: "auth.pwaReady",
+      authPolicy: "public",
+      stability: "preview",
+      summary: "Whether an installed app's sign-in has completed"
+    }), async (req, reply) => {
       const nonce = (req.query.nonce ?? "").trim();
       if (!nonce) return reply.status(400).send({ error: "missing_nonce" });
       const result = await consumePwaNonce(db, nonce);
@@ -38234,6 +38398,7 @@ import { nanoid as nanoid41 } from "nanoid";
 init_settings();
 init_users();
 init_cli_tokens();
+init_route_registry();
 var REQUEST_TTL_MS = 15 * 6e4;
 var APPROVAL_TTL_MS = 24 * 60 * 6e4;
 async function cliBootstrapRoutes(app, deps) {
@@ -38267,15 +38432,18 @@ async function cliBootstrapRoutes(app, deps) {
   }
   app.post(
     "/cli/bootstrap-request",
-    {
-      schema: {
-        body: {
-          type: "object",
-          required: ["email"],
-          properties: { email: { type: "string", minLength: 3, maxLength: 254 } }
-        }
+    routeMeta({
+      surface: "bootstrap",
+      operationId: "bootstrap.request",
+      authPolicy: "public",
+      stability: "preview",
+      summary: "A CLI asks to be connected to an account",
+      requestSchema: {
+        type: "object",
+        required: ["email"],
+        properties: { email: { type: "string", minLength: 3, maxLength: 254 } }
       }
-    },
+    }),
     async (req, reply) => {
       const email = (req.body.email ?? "").trim().toLowerCase();
       if (!isValidEmail(email)) {
@@ -38323,6 +38491,14 @@ async function cliBootstrapRoutes(app, deps) {
   );
   app.get(
     "/cli/authorize",
+    routeMeta({
+      surface: "bootstrap",
+      operationId: "bootstrap.authorizePage",
+      authPolicy: "public",
+      // An HTML page, not a JSON operation to generate a client for.
+      stability: "internal",
+      summary: "The page where a person confirms a CLI connection"
+    }),
     async (req, reply) => {
       const requestId = (req.query.request ?? "").trim();
       const row = requestId ? await loadRequest(requestId) : void 0;
@@ -38371,15 +38547,19 @@ async function cliBootstrapRoutes(app, deps) {
   );
   app.post(
     "/cli/authorize/confirm",
-    {
-      schema: {
-        body: {
-          type: "object",
-          required: ["request"],
-          properties: { request: { type: "string", minLength: 1, maxLength: 64 } }
-        }
+    routeMeta({
+      surface: "bootstrap",
+      operationId: "bootstrap.authorizeConfirm",
+      // A cookie, or the single-owner's credential on the local profile.
+      authPolicy: "application_actor",
+      stability: "preview",
+      summary: "Confirm a CLI connection as the signed-in person",
+      requestSchema: {
+        type: "object",
+        required: ["request"],
+        properties: { request: { type: "string", minLength: 1, maxLength: 64 } }
       }
-    },
+    }),
     async (req, reply) => {
       const session = await readSession(db, req);
       if (!session || !await isAllowedLogin(db, config, session.email)) {
@@ -38397,15 +38577,18 @@ async function cliBootstrapRoutes(app, deps) {
   );
   app.post(
     "/cli/authorize/email",
-    {
-      schema: {
-        body: {
-          type: "object",
-          required: ["request"],
-          properties: { request: { type: "string", minLength: 1, maxLength: 64 } }
-        }
+    routeMeta({
+      surface: "bootstrap",
+      operationId: "bootstrap.authorizeEmail",
+      authPolicy: "public",
+      stability: "preview",
+      summary: "Confirm a CLI connection by email instead",
+      requestSchema: {
+        type: "object",
+        required: ["request"],
+        properties: { request: { type: "string", minLength: 1, maxLength: 64 } }
       }
-    },
+    }),
     async (req, reply) => {
       const requestId = (req.body.request ?? "").trim();
       const row = await loadRequest(requestId);
@@ -38423,6 +38606,13 @@ async function cliBootstrapRoutes(app, deps) {
   );
   app.get(
     "/cli/bootstrap-confirm",
+    routeMeta({
+      surface: "bootstrap",
+      operationId: "bootstrap.confirm",
+      authPolicy: "public",
+      stability: "internal",
+      summary: "Redeem the CLI connection link from the email"
+    }),
     async (req, reply) => {
       const token = (req.query.token ?? "").trim();
       reply.type("text/html");
@@ -38473,6 +38663,13 @@ async function cliBootstrapRoutes(app, deps) {
   );
   app.get(
     "/cli/bootstrap-poll",
+    routeMeta({
+      surface: "bootstrap",
+      operationId: "bootstrap.poll",
+      authPolicy: "public",
+      stability: "preview",
+      summary: "A CLI polls whether its connection was confirmed"
+    }),
     async (req, reply) => {
       const requestId = (req.query.request ?? "").trim();
       if (!requestId) return reply.status(400).send({ error: "missing_request" });
@@ -38512,13 +38709,20 @@ import { nanoid as nanoid42 } from "nanoid";
 init_auth();
 init_settings();
 init_users();
+init_route_registry();
 var CHALLENGE_TTL_MS = 10 * 6e4;
 var MIN_FILL_MS = 2e3;
 async function registrationRoutes(app, deps) {
   const { db, config, mailer } = deps;
   const submitByIp = createAbuseThrottle({ windowMs: 60 * 6e4, max: 10 });
   const challengeByIp = createAbuseThrottle({ windowMs: 60 * 6e4, max: 60 });
-  app.get("/auth/register-challenge", async (req, reply) => {
+  app.get("/auth/register-challenge", routeMeta({
+    surface: "bootstrap",
+    operationId: "auth.registerChallenge",
+    authPolicy: "public",
+    stability: "preview",
+    summary: "The challenge a registration form answers"
+  }), async (req, reply) => {
     if (!challengeByIp.take(`ip:${req.ip}`)) {
       return reply.status(429).send({ error: "too_many_requests" });
     }
@@ -38532,21 +38736,24 @@ async function registrationRoutes(app, deps) {
   });
   app.post(
     "/auth/register",
-    {
-      schema: {
-        body: {
-          type: "object",
-          required: ["email", "challengeId"],
-          properties: {
-            email: { type: "string", minLength: 3, maxLength: 254 },
-            name: { type: "string", maxLength: 200 },
-            note: { type: "string", maxLength: 1e3 },
-            challengeId: { type: "string", minLength: 1, maxLength: 64 },
-            website: { type: "string", maxLength: 200 }
-          }
+    routeMeta({
+      surface: "bootstrap",
+      operationId: "auth.register",
+      authPolicy: "public",
+      stability: "preview",
+      summary: "Ask for an account",
+      requestSchema: {
+        type: "object",
+        required: ["email", "challengeId"],
+        properties: {
+          email: { type: "string", minLength: 3, maxLength: 254 },
+          name: { type: "string", maxLength: 200 },
+          note: { type: "string", maxLength: 1e3 },
+          challengeId: { type: "string", minLength: 1, maxLength: 64 },
+          website: { type: "string", maxLength: 200 }
         }
       }
-    },
+    }),
     async (req, reply) => {
       const email = (req.body.email ?? "").trim().toLowerCase();
       const name = (req.body.name ?? "").trim() || null;
@@ -38594,7 +38801,13 @@ async function registrationRoutes(app, deps) {
       return reply.status(202).send({ status: "pending" });
     }
   );
-  app.get("/auth/register-approve", async (req, reply) => {
+  app.get("/auth/register-approve", routeMeta({
+    surface: "bootstrap",
+    operationId: "auth.registerApprove",
+    authPolicy: "public",
+    stability: "internal",
+    summary: "Approve a registration request from its link"
+  }), async (req, reply) => {
     const token = (req.query.token ?? "").trim();
     const row = token ? await db.get(`SELECT id, email, name, note, status, approve_token as approveToken,
                     reject_token as rejectToken, created_at as createdAt,
@@ -38614,7 +38827,13 @@ async function registrationRoutes(app, deps) {
       )
     );
   });
-  app.get("/auth/register-reject", async (req, reply) => {
+  app.get("/auth/register-reject", routeMeta({
+    surface: "bootstrap",
+    operationId: "auth.registerReject",
+    authPolicy: "public",
+    stability: "internal",
+    summary: "Reject a registration request from its link"
+  }), async (req, reply) => {
     const token = (req.query.token ?? "").trim();
     const row = token ? await db.get(`SELECT id, email, name, status FROM registration_requests WHERE reject_token = ?`, token) : void 0;
     if (!row) {
@@ -38816,6 +39035,7 @@ function safeNext(next) {
 }
 
 // src/routes/install.ts
+init_route_registry();
 import { fileURLToPath as fileURLToPath2 } from "node:url";
 import { dirname as dirname3, resolve as resolve2 } from "node:path";
 import { existsSync as existsSync6 } from "node:fs";
@@ -38826,7 +39046,14 @@ var SCRIPT_PATH = [
   resolve2(MODULE_DIR2, "../../../deploy/install-sandbox.sh")
 ].find((p) => existsSync6(p)) ?? resolve2(MODULE_DIR2, "../../../deploy/install-sandbox.sh");
 async function installRoutes(app) {
-  app.get("/install-sandbox.sh", async (_req, reply) => {
+  app.get("/install-sandbox.sh", routeMeta({
+    surface: "static",
+    operationId: "ops.installSandboxScript",
+    authPolicy: "public",
+    // A shell script, not a JSON operation.
+    stability: "internal",
+    summary: "The SANDBOX install script"
+  }), async (_req, reply) => {
     try {
       const body = await readFile(SCRIPT_PATH, "utf8");
       return reply.type("text/x-shellscript; charset=utf-8").send(body);
@@ -41561,9 +41788,11 @@ async function buildServer(config, db) {
       }
     });
   }
-  const routeRegistry = installRouteGuard(app, "observe", {
-    warn: (message) => app.log.warn(message)
-  });
+  const routeRegistry = installRouteGuard(app, "enforce", { warn: (message) => app.log.warn(message) }, [
+    ...LEGACY_ROUTES,
+    ...STATIC_PLUGIN_ROUTES
+  ]);
+  app.decorate("routeRegistry", routeRegistry);
   const mailer = buildMailer(loadMailerConfig(), app.log);
   app.log.info({ mailer: mailer.mode }, "mailer mode");
   const notifyDeps = {
@@ -41785,10 +42014,9 @@ async function buildServer(config, db) {
     app.log.info(
       {
         classified: routeRegistry.list().length,
-        unclassified: routeRegistry.unclassifiedCount(),
-        invalid: routeRegistry.invalidCount()
+        legacy: routeRegistry.unclassifiedRoutes().filter((r) => !STATIC_PLUGIN_ROUTES.includes(r)).length
       },
-      "route registry: routes still to declare their metadata"
+      "route registry: legacy routes still served for the browser"
     );
   });
   await registerSpaHosts(app, {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@code-partner/codepipe-hub",
-  "version": "0.14.1-dev.423.ga49d1f61",
+  "version": "0.14.1-dev.424.ge3c8cc77",
   "description": "The CodePipe hub, packaged for one machine: the CLI installs it on demand for the local profile.",
   "type": "module",
   "main": "./hub/dist/index.js",