@codraoss/api 0.9.4

package/dist/index.js

@@ -0,0 +1,1165 @@
+// src/router.ts
+import { Hono as Hono9 } from "hono";
+
+// src/middleware/auth.ts
+import { createMiddleware } from "hono/factory";
+
+// src/http.ts
+function jsonError(message, status = 400) {
+  return Response.json({ error: message }, { status });
+}
+function wantsHtml(request) {
+  const accept = request.headers.get("accept") ?? "";
+  return accept.includes("text/html");
+}
+
+// src/sessions.ts
+import { deleteCookie, getCookie, setCookie } from "hono/cookie";
+var SESSION_COOKIE_NAME = "codra_session";
+var SESSION_TTL_SECONDS = 60 * 60 * 24 * 7;
+async function createSession(c, session) {
+  const token = await c.env.deps.sessionStore.createSession(session);
+  setCookie(c, SESSION_COOKIE_NAME, token, {
+    httpOnly: true,
+    sameSite: "Lax",
+    secure: true,
+    path: "/",
+    maxAge: SESSION_TTL_SECONDS
+  });
+  c.set("sessionToken", token);
+  c.set("sessionUser", session);
+  return token;
+}
+async function destroySession(c) {
+  const token = getCookie(c, SESSION_COOKIE_NAME);
+  if (token) {
+    await c.env.deps.sessionStore.destroySession(token);
+  }
+  c.set("sessionToken", null);
+  c.set("sessionUser", null);
+  deleteCookie(c, SESSION_COOKIE_NAME, {
+    path: "/"
+  });
+}
+async function readSession(c) {
+  const token = getCookie(c, SESSION_COOKIE_NAME) ?? null;
+  c.set("sessionToken", token);
+  if (!token) {
+    c.set("sessionUser", null);
+    return null;
+  }
+  const session = await c.env.deps.sessionStore.readSession(token);
+  c.set("sessionUser", session);
+  return session;
+}
+
+// src/middleware/auth.ts
+var requireSession = createMiddleware(async (c, next) => {
+  const session = await readSession(c);
+  if (!session) {
+    if (wantsHtml(c.req.raw)) {
+      return c.redirect("/login");
+    }
+    return Response.json({ error: "Unauthorized" }, { status: 401 });
+  }
+  await next();
+});
+
+// src/middleware/csrf.ts
+import { createMiddleware as createMiddleware2 } from "hono/factory";
+var SAFE_METHODS = /* @__PURE__ */ new Set(["GET", "HEAD", "OPTIONS"]);
+var REQUESTED_WITH = "XMLHttpRequest";
+var requireCsrfHeader = createMiddleware2(async (c, next) => {
+  if (SAFE_METHODS.has(c.req.method.toUpperCase())) {
+    await next();
+    return;
+  }
+  if (c.req.header("x-requested-with") !== REQUESTED_WITH) {
+    return c.json({ error: "Forbidden" }, 403);
+  }
+  await next();
+});
+
+// src/logger.ts
+import { AsyncLocalStorage } from "async_hooks";
+import { formatLogRecord, setLoggerSink } from "@codraoss/core/logger";
+var storage = new AsyncLocalStorage();
+var Logger = class _Logger {
+  constructor(context = {}) {
+    this.context = context;
+  }
+  context;
+  withContext(newContext) {
+    return new _Logger({ ...this.context, ...newContext });
+  }
+  log(level, message, data) {
+    const store = storage.getStore() || {};
+    const output = formatLogRecord(level, message, [store, this.context], data);
+    if (level === "error") {
+      console.error(JSON.stringify(output));
+    } else if (level === "warn") {
+      console.warn(JSON.stringify(output));
+    } else {
+      console.log(JSON.stringify(output));
+    }
+  }
+  runWithContext(context, fn) {
+    return storage.run({ ...storage.getStore(), ...context }, fn);
+  }
+  info(message, data) {
+    this.log("info", message, data);
+  }
+  error(message, data) {
+    if (data instanceof Error) {
+      this.log("error", message, {
+        name: data.name,
+        message: data.message,
+        stack: data.stack
+      });
+    } else {
+      this.log("error", message, data);
+    }
+  }
+  warn(message, data) {
+    this.log("warn", message, data);
+  }
+  debug(message, data) {
+    this.log("debug", message, data);
+  }
+};
+var logger = new Logger();
+setLoggerSink(logger);
+
+// src/middleware/observability.ts
+var observability = async (c, next) => {
+  const requestId = c.req.header("x-request-id") || crypto.randomUUID();
+  c.set("requestId", requestId);
+  return logger.runWithContext({
+    requestId,
+    method: c.req.method,
+    path: c.req.path
+  }, async () => {
+    logger.info(`Incoming request: ${c.req.method} ${c.req.path}`);
+    const start = Date.now();
+    await next();
+    const duration = Date.now() - start;
+    logger.info(`Request completed: ${c.req.method} ${c.req.path}`, {
+      status: c.res.status,
+      durationMs: duration
+    });
+  });
+};
+
+// src/routes/auth.ts
+import { Hono } from "hono";
+function redirectToLogin(reason) {
+  const params = new URLSearchParams({ error: reason });
+  return `/login?${params.toString()}`;
+}
+function parseAllowedUsers(input) {
+  return new Set(
+    input.split(",").map((value) => value.trim().toLowerCase()).filter(Boolean)
+  );
+}
+function createAuthRouter() {
+  const app = new Hono();
+  app.get("/github", async (c) => {
+    const state = await c.env.deps.authProvider.createOAuthState();
+    const result = await c.env.deps.authProvider.beginAuthorization(c.env.AUTH_CALLBACK_URL, state);
+    return c.redirect(result.url, 302);
+  });
+  app.get("/github/callback", async (c) => {
+    const error = c.req.query("error");
+    if (error) {
+      return c.redirect(redirectToLogin(error), 302);
+    }
+    const code = c.req.query("code")?.trim();
+    const state = c.req.query("state")?.trim();
+    if (!code || !state) {
+      return c.redirect(redirectToLogin("invalid_callback"), 302);
+    }
+    const stateMatches = await c.env.deps.authProvider.consumeOAuthState(state);
+    if (!stateMatches) {
+      return c.redirect(redirectToLogin("invalid_state"), 302);
+    }
+    try {
+      const { identity } = await c.env.deps.authProvider.completeAuthorization(code, state, state);
+      const allowedUsers = parseAllowedUsers(c.env.DASHBOARD_ALLOWED_USERS);
+      if (!allowedUsers.has(identity.login.toLowerCase())) {
+        return c.redirect(redirectToLogin("not_allowed"), 302);
+      }
+      await destroySession(c);
+      await createSession(c, identity);
+      try {
+        await c.env.deps.repositories.accounts.upsertAccountSettings(c.env, {
+          githubUserId: Number(identity.providerUserId),
+          githubUsername: identity.login,
+          accountName: identity.name,
+          accountEmail: identity.email
+        });
+      } catch (err) {
+        c.env.deps.platform.logger.warn("Failed to persist account settings on sign-in", {
+          error: err instanceof Error ? err.message : String(err)
+        });
+      }
+      return c.redirect("/dashboard", 302);
+    } catch {
+      return c.redirect(redirectToLogin("oauth_failed"), 302);
+    }
+  });
+  app.post("/logout", async (c) => {
+    await destroySession(c);
+    return c.json({ ok: true });
+  });
+  return app;
+}
+
+// src/routes/webhook.ts
+import { Hono as Hono2 } from "hono";
+import {
+  isFeedbackGitHubWebhookEvent
+} from "@codraoss/schema/github";
+async function handleFeedbackEvent(c, input) {
+  const { eventName, payload, repositoryId } = input;
+  if (repositoryId === null) return 0;
+  const botLogin = (c.env.BOT_USERNAME ?? "").toLowerCase();
+  const isOurs = (comment) => Boolean(botLogin) && (comment.user?.login ?? "").toLowerCase().startsWith(botLogin);
+  const prNumber = payload.pull_request?.number ?? null;
+  const entries = [];
+  const reopened = [];
+  const add = (comment, outcome) => {
+    if (!isOurs(comment) || !comment?.body) return;
+    const markerMatch = (comment.body || "").match(/<!-- codra-fp: (.*?) -->/);
+    if (!markerMatch) return;
+    let fingerprint = markerMatch[1];
+    let anchorHash = "";
+    let fingerprintV2 = null;
+    try {
+      const parts = JSON.parse(fingerprint);
+      if (Array.isArray(parts) && parts.length >= 2) {
+        fingerprintV2 = parts[0];
+        fingerprint = parts[1];
+        if (parts.length >= 3) anchorHash = parts[2];
+      }
+    } catch {
+    }
+    entries.push({
+      repositoryId,
+      prNumber,
+      fingerprint,
+      anchorHash,
+      fingerprintV2,
+      githubCommentId: comment.id,
+      outcome
+    });
+  };
+  if (eventName === "pull_request_review_comment") {
+    const { action, comment } = payload;
+    if (action === "created") add(comment, "posted");
+    else if (action === "deleted") add(comment, "deleted");
+  } else if (eventName === "pull_request_review_thread") {
+    const { action, thread } = payload;
+    for (const comment of thread?.comments ?? []) {
+      if (action === "resolved") {
+        add(comment, "resolved");
+      } else if (action === "unresolved") {
+        add(comment, "unresolved");
+        if (isOurs(comment)) reopened.push(comment.id);
+      }
+    }
+  }
+  if (entries.length === 0) return 0;
+  try {
+    const feedbackRepo = c.env.deps.repositories.commentFeedback;
+    if (reopened.length > 0) await feedbackRepo.clearResolvedFeedback(c.env, repositoryId, reopened);
+    return await feedbackRepo.recordCommentFeedback(c.env, entries);
+  } catch (error) {
+    c.env.deps.platform.logger.warn("Could not record comment feedback", {
+      eventName,
+      repositoryId,
+      error: error instanceof Error ? error.message : String(error)
+    });
+    return 0;
+  }
+}
+async function handleGitHubWebhook(c) {
+  const eventName = c.req.header("x-github-event");
+  const deliveryId = c.req.header("x-github-delivery");
+  const signature = c.req.header("x-hub-signature-256");
+  const rawBody = await c.req.text();
+  if (!eventName || !deliveryId) {
+    return jsonError("Missing GitHub webhook headers.", 400);
+  }
+  const verified = await c.env.deps.webhook.verifySignature(signature ?? null, rawBody);
+  if (!verified) {
+    return jsonError("Invalid webhook signature.", 401);
+  }
+  let payload;
+  try {
+    payload = JSON.parse(rawBody);
+  } catch {
+    return jsonError("Invalid webhook JSON payload.", 400);
+  }
+  const isFeedbackEvent = isFeedbackGitHubWebhookEvent(eventName);
+  const delivery = await c.env.deps.repositories.webhookDeliveries.recordWebhookDelivery(c.env, {
+    deliveryId,
+    eventName,
+    owner: "repository" in payload ? payload.repository.owner.login : null,
+    repo: "repository" in payload ? payload.repository.name : null,
+    payload: isFeedbackEvent ? null : payload
+  });
+  if (!delivery.inserted) {
+    return c.json({ ok: true, duplicate: true }, 202);
+  }
+  const installationId = String(payload.installation?.id ?? "");
+  if (!installationId || !("repository" in payload) || !payload.repository) {
+    return c.json({ ok: true, ignored: true }, 202);
+  }
+  if (isFeedbackEvent) {
+    const recorded = await handleFeedbackEvent(c, {
+      eventName,
+      payload,
+      repositoryId: delivery.repositoryId
+    });
+    return c.json({ ok: true, feedback: true, recorded }, 202);
+  }
+  const normalized = c.env.deps.webhook.normalizePayload(eventName, payload);
+  if (!normalized) {
+    return c.json({ ok: true, ignored: true, eventName }, 202);
+  }
+  const repoConfig = await c.env.deps.config.loadRepoConfig({
+    installationId,
+    owner: payload.repository.owner.login,
+    repo: payload.repository.name
+  });
+  if (repoConfig.enabled === false) {
+    return c.json({ ok: true, ignored: true, reason: "repository_disabled" }, 202);
+  }
+  const extracted = c.env.deps.webhook.extractReviewRequest({
+    eventName: normalized.eventName,
+    payload: normalized.payload,
+    botUsername: c.env.BOT_USERNAME,
+    config: repoConfig.parsedJson
+  });
+  if (extracted?.commitSha && extracted.baseSha) {
+    const jobsRepo = c.env.deps.repositories.jobs;
+    const existingJob = await jobsRepo.findExistingJobForHead(c.env, {
+      owner: extracted.owner,
+      repo: extracted.repo,
+      prNumber: extracted.prNumber,
+      commitSha: extracted.commitSha,
+      trigger: extracted.trigger
+    });
+    if (existingJob) {
+      return c.json({
+        ok: true,
+        duplicate: true,
+        message: existingJob.status === "queued" ? "queued" : "duplicate",
+        job: existingJob
+      }, 202);
+    }
+    const job = await jobsRepo.insertJob(c.env, {
+      installationId: extracted.installationId,
+      owner: extracted.owner,
+      repo: extracted.repo,
+      prNumber: extracted.prNumber,
+      prTitle: extracted.prTitle,
+      prAuthor: extracted.prAuthor,
+      commitSha: extracted.commitSha,
+      baseSha: extracted.baseSha,
+      trigger: extracted.trigger,
+      headRef: extracted.headRef,
+      baseRef: extracted.baseRef,
+      configSnapshot: repoConfig.parsedJson
+    });
+    await jobsRepo.supersedeOlderJobs(c.env, {
+      installationId: extracted.installationId,
+      owner: extracted.owner,
+      repo: extracted.repo,
+      prNumber: extracted.prNumber,
+      newJobId: job.id
+    });
+    await c.env.deps.platform.enqueueReviewJob({
+      jobId: job.id,
+      deliveryId,
+      phase: "prepare",
+      requestId: c.get("requestId")
+    });
+    return c.json({ ok: true, message: "queued", job }, 202);
+  }
+  await c.env.deps.platform.enqueueReviewJob({
+    deliveryId,
+    eventName,
+    requestId: c.get("requestId")
+  });
+  return c.json({ ok: true, message: "queued" }, 202);
+}
+function createWebhookRouter() {
+  const app = new Hono2();
+  app.post("/", handleGitHubWebhook);
+  return app;
+}
+
+// src/routes/api/auth.ts
+import { isSupportedTimeZone } from "@codraoss/schema/timezone";
+import { Hono as Hono3 } from "hono";
+import { z } from "zod";
+var emailSchema = z.strictObject({
+  email: z.string().trim().email().max(254)
+});
+var accountUpdateSchema = z.strictObject({
+  name: z.string().trim().min(1).max(120).optional(),
+  timezone: z.string().trim().min(1).max(64).refine(isSupportedTimeZone, {
+    message: "Unknown time zone."
+  }).nullable().optional()
+}).refine(
+  (body) => body.name !== void 0 || body.timezone !== void 0,
+  { message: "Nothing to update." }
+);
+function createAuthApiRouter() {
+  const app = new Hono3();
+  app.get("/session", async (c) => {
+    const sessionUser = c.get("sessionUser");
+    if (!sessionUser) {
+      return Response.json({ error: "Unauthorized" }, { status: 401 });
+    }
+    return c.json({ user: sessionUser });
+  });
+  app.get("/account", async (c) => {
+    const sessionUser = c.get("sessionUser");
+    if (!sessionUser) {
+      return Response.json({ error: "Unauthorized" }, { status: 401 });
+    }
+    const accounts = c.env.deps.repositories.accounts;
+    const githubUserId = Number(sessionUser.providerUserId);
+    let account = await accounts.getAccountSettings(c.env, githubUserId);
+    if (!account) {
+      account = await accounts.upsertAccountSettings(c.env, {
+        githubUserId,
+        githubUsername: sessionUser.login,
+        accountName: sessionUser.name,
+        accountEmail: sessionUser.email
+      });
+    }
+    return c.json({ account });
+  });
+  app.patch("/account", async (c) => {
+    const sessionUser = c.get("sessionUser");
+    if (!sessionUser) {
+      return Response.json({ error: "Unauthorized" }, { status: 401 });
+    }
+    const body = await c.req.json().catch(() => null);
+    const parsed = accountUpdateSchema.safeParse(body);
+    if (!parsed.success) {
+      const issue = parsed.error.issues[0]?.message;
+      return jsonError(
+        issue && issue !== "Invalid input" ? issue : "Enter a name (1-120 characters).",
+        400
+      );
+    }
+    const accounts = c.env.deps.repositories.accounts;
+    const githubUserId = Number(sessionUser.providerUserId);
+    const existing = await accounts.getAccountSettings(c.env, githubUserId);
+    if (!existing) {
+      await accounts.upsertAccountSettings(c.env, {
+        githubUserId,
+        githubUsername: sessionUser.login,
+        accountName: sessionUser.name,
+        accountEmail: sessionUser.email
+      });
+    }
+    const account = await accounts.updateAccountSettings(c.env, githubUserId, {
+      accountName: parsed.data.name,
+      timezone: parsed.data.timezone
+    });
+    return c.json({ account });
+  });
+  app.get("/updates-email", async (c) => {
+    const sessionUser = c.get("sessionUser");
+    if (!sessionUser) {
+      return Response.json({ error: "Unauthorized" }, { status: 401 });
+    }
+    const githubUserId = Number(sessionUser.providerUserId);
+    const preference = await c.env.deps.platform.getUpdatesEmailPreference(githubUserId);
+    return c.json({
+      status: preference?.status ?? "pending",
+      email: preference?.email ?? null,
+      updatedAt: preference?.updatedAt ?? null
+    });
+  });
+  app.post("/updates-email", async (c) => {
+    const sessionUser = c.get("sessionUser");
+    if (!sessionUser) {
+      return Response.json({ error: "Unauthorized" }, { status: 401 });
+    }
+    const body = await c.req.json().catch(() => null);
+    const parsed = emailSchema.safeParse(body);
+    if (!parsed.success) {
+      return jsonError("Enter a valid email address.", 400);
+    }
+    const platform = c.env.deps.platform;
+    const githubUserId = Number(sessionUser.providerUserId);
+    const existingPreference = await platform.getUpdatesEmailPreference(githubUserId);
+    if (existingPreference) {
+      return c.json({
+        status: existingPreference.status,
+        email: existingPreference.email,
+        updatedAt: existingPreference.updatedAt
+      });
+    }
+    const synced = await platform.syncUpdatesEmail(githubUserId, parsed.data.email);
+    if (!synced) {
+      return jsonError("Could not save updates email right now.", 502);
+    }
+    const preference = await platform.getUpdatesEmailPreference(githubUserId);
+    return c.json({
+      status: preference?.status ?? "pending",
+      email: preference?.email ?? null,
+      updatedAt: preference?.updatedAt ?? null
+    });
+  });
+  return app;
+}
+
+// src/routes/api/jobs.ts
+import { Hono as Hono4 } from "hono";
+import { defaultRepoConfig, findingLabelSchema, jobsQuerySchema } from "@codraoss/schema";
+import { parseUnifiedDiff } from "@codraoss/core/diff";
+import { buildFileReviewPrompts } from "@codraoss/core/prompts/file-review";
+async function terminateJobWorkflow(c, job) {
+  await c.env.deps.platform.terminateJobWorkflow(job);
+}
+function jobEtag(input) {
+  return `"job-${input.id}-${input.status}-${input.fileCount}-${input.commentCount}-${new Date(input.updatedAt).getTime()}"`;
+}
+function getExecutionContext(c) {
+  try {
+    return c.executionCtx;
+  } catch {
+    return void 0;
+  }
+}
+function createJobsRouter() {
+  const app = new Hono4();
+  app.get("/", async (c) => {
+    c.env.deps.platform.scheduleBestEffortJobMaintenance(getExecutionContext(c));
+    const rawQuery = c.req.query();
+    const query = jobsQuerySchema.parse(rawQuery);
+    const result = await c.env.deps.repositories.jobs.listJobs(c.env, query);
+    return c.json(result);
+  });
+  app.get("/:id", async (c) => {
+    c.env.deps.platform.scheduleBestEffortJobMaintenance(getExecutionContext(c));
+    const job = await c.env.deps.repositories.jobs.getJobDetail(c.env, c.req.param("id"));
+    if (!job) {
+      return jsonError("Job not found.", 404);
+    }
+    const etag = jobEtag(job);
+    const lastModified = new Date(job.updatedAt).toUTCString();
+    if (c.req.header("if-none-match") === etag) {
+      return new Response(null, {
+        status: 304,
+        headers: {
+          ETag: etag,
+          "Last-Modified": lastModified
+        }
+      });
+    }
+    const response = c.json({ job });
+    response.headers.set("ETag", etag);
+    response.headers.set("Last-Modified", lastModified);
+    response.headers.set("Cache-Control", "private, no-cache");
+    return response;
+  });
+  app.get("/:id/diffs", async (c) => {
+    const job = await c.env.deps.repositories.jobs.getJobDetail(c.env, c.req.param("id"));
+    if (!job) {
+      return jsonError("Job not found.", 404);
+    }
+    const config = job.configSnapshot ?? defaultRepoConfig;
+    const github = c.env.deps.gitProvider.createService(job.installationId);
+    let rawDiff;
+    try {
+      rawDiff = await c.env.deps.platform.getOrFetchRawDiffForCompletedJob(
+        c.env.deps.platform.createReviewRuntime(),
+        { id: job.id, owner: job.owner, repo: job.repo, baseSha: job.baseSha, commitSha: job.commitSha },
+        github
+      );
+    } catch (error) {
+      c.env.deps.platform.logger.warn(`Could not reconstruct diff for job ${job.id}`, error instanceof Error ? error : new Error(String(error)));
+      return c.json({ diffs: {} });
+    }
+    let prDescription = null;
+    try {
+      prDescription = (await github.getPullRequest(job.owner, job.repo, job.prNumber)).body ?? null;
+    } catch (error) {
+      c.env.deps.platform.logger.warn(
+        `Could not load the PR body for job ${job.id}; prompts will omit the description`,
+        error instanceof Error ? error : new Error(String(error))
+      );
+    }
+    const diffs = {};
+    for (const file of parseUnifiedDiff(rawDiff, config.review)) {
+      if (file.isDeleted || file.isBinary || !file.path) continue;
+      diffs[file.path] = buildFileReviewPrompts({
+        file,
+        prTitle: job.prTitle,
+        prDescription,
+        config: config.review
+      }).userPrompt;
+    }
+    const response = c.json({ diffs });
+    response.headers.set("Cache-Control", "private, max-age=60");
+    return response;
+  });
+  async function startReplacementJob(c, rawSource, options) {
+    const jobs = c.env.deps.repositories.jobs;
+    const source = jobs.mapJob(rawSource);
+    let configSnapshot;
+    try {
+      const currentConfig = await c.env.deps.config.loadRepoConfig({
+        installationId: source.installationId,
+        owner: source.owner,
+        repo: source.repo
+      });
+      configSnapshot = currentConfig?.parsedJson ?? defaultRepoConfig;
+    } catch (e) {
+      configSnapshot = defaultRepoConfig;
+    }
+    const job = await jobs.insertJob(c.env, {
+      installationId: source.installationId,
+      owner: source.owner,
+      repo: source.repo,
+      prNumber: source.prNumber,
+      prTitle: source.prTitle,
+      prAuthor: source.prAuthor,
+      commitSha: source.commitSha,
+      baseSha: jobs.bytesToHex(rawSource.base_sha),
+      // base_sha is only in raw row/detail
+      trigger: "retry",
+      headRef: rawSource.head_ref,
+      baseRef: rawSource.base_ref,
+      configSnapshot,
+      ...options.inherit ? { retryOfJobId: source.id } : {}
+    });
+    await jobs.supersedeOlderJobs(c.env, {
+      installationId: source.installationId,
+      owner: source.owner,
+      repo: source.repo,
+      prNumber: source.prNumber,
+      newJobId: job.id
+    });
+    await c.env.deps.platform.enqueueReviewJob({
+      jobId: job.id,
+      deliveryId: crypto.randomUUID(),
+      phase: "prepare",
+      requestId: c.get("requestId")
+    });
+    return job;
+  }
+  app.post("/:id/retry", async (c) => {
+    const jobs = c.env.deps.repositories.jobs;
+    const rawSource = await jobs.getJobForProcessing(c.env, c.req.param("id"));
+    if (!rawSource) {
+      return jsonError("Job not found.", 404);
+    }
+    const job = await startReplacementJob(c, rawSource, { inherit: true });
+    return c.json({ job }, 202);
+  });
+  app.post("/:id/rerun", async (c) => {
+    const jobs = c.env.deps.repositories.jobs;
+    const rawSource = await jobs.getJobForProcessing(c.env, c.req.param("id"));
+    if (!rawSource) {
+      return jsonError("Job not found.", 404);
+    }
+    const source = jobs.mapJob(rawSource);
+    if (source.status === "queued" || source.status === "running") {
+      await terminateJobWorkflow(c, source);
+    }
+    const job = await startReplacementJob(c, rawSource, { inherit: false });
+    return c.json({ job }, 202);
+  });
+  app.post("/:id/stop", async (c) => {
+    const jobs = c.env.deps.repositories.jobs;
+    const id = c.req.param("id");
+    const raw = await jobs.getJobForProcessing(c.env, id);
+    if (!raw) {
+      return jsonError("Job not found.", 404);
+    }
+    const job = jobs.mapJob(raw);
+    if (job.status !== "queued" && job.status !== "running") {
+      return jsonError("Only a queued or running job can be stopped.", 409);
+    }
+    await terminateJobWorkflow(c, job);
+    await jobs.cancelJob(c.env, id);
+    const updated = await jobs.getJobForProcessing(c.env, id);
+    return c.json({ job: updated ? jobs.mapJob(updated) : job }, 200);
+  });
+  app.put("/:id/findings/:fingerprint/label", async (c) => {
+    const jobId = c.req.param("id");
+    const fingerprint = c.req.param("fingerprint");
+    const parsed = findingLabelSchema.safeParse(await c.req.json().catch(() => null));
+    if (!parsed.success) return jsonError('Body must be {"label":"right"|"wrong"}.', 400);
+    const target = await c.env.deps.repositories.fileReviews.getFindingLabelTarget(c.env, jobId, fingerprint);
+    if (!target) return jsonError("Finding not found on this job.", 404);
+    await c.env.deps.repositories.commentFeedback.upsertDashboardFeedback(c.env, {
+      repositoryId: target.repository_id,
+      prNumber: target.pr_number,
+      fingerprint,
+      anchorHash: target.anchor_hash,
+      // Carried so a rejection survives the model rewording its title.
+      fingerprintV2: target.fingerprint_v2,
+      jobId,
+      labelledBy: c.get("sessionUser")?.providerUserId ? Number(c.get("sessionUser")?.providerUserId) : null,
+      outcome: parsed.data.label === "wrong" ? "marked_wrong" : "marked_right"
+    });
+    return c.json({ label: parsed.data.label }, 200);
+  });
+  app.delete("/:id/findings/:fingerprint/label", async (c) => {
+    const jobId = c.req.param("id");
+    const fingerprint = c.req.param("fingerprint");
+    const target = await c.env.deps.repositories.fileReviews.getFindingLabelTarget(c.env, jobId, fingerprint);
+    if (!target) return jsonError("Finding not found on this job.", 404);
+    await c.env.deps.repositories.commentFeedback.clearDashboardFeedback(c.env, target.repository_id, fingerprint);
+    return c.body(null, 204);
+  });
+  app.delete("/:id", async (c) => {
+    const jobs = c.env.deps.repositories.jobs;
+    const id = c.req.param("id");
+    const raw = await jobs.getJobForProcessing(c.env, id);
+    if (!raw) {
+      return jsonError("Job not found.", 404);
+    }
+    const job = jobs.mapJob(raw);
+    if (job.status === "queued" || job.status === "running") {
+      await terminateJobWorkflow(c, job);
+    }
+    await jobs.deleteJob(c.env, id);
+    return c.body(null, 204);
+  });
+  return app;
+}
+
+// src/routes/api/repos.ts
+import { Hono as Hono5 } from "hono";
+import { z as z2 } from "zod";
+import { repoConfigSchema } from "@codraoss/schema";
+var repoConfigPatchSchema = z2.strictObject({
+  enabled: z2.boolean().optional(),
+  review: repoConfigSchema.shape.review.optional(),
+  model: repoConfigSchema.shape.model.optional()
+}).refine(
+  (patch) => patch.enabled !== void 0 || patch.review !== void 0 || patch.model !== void 0,
+  "Repository config patch cannot be empty."
+);
+async function mapWithConcurrency(items, limit, mapper) {
+  const results = new Array(items.length);
+  let nextIndex = 0;
+  async function worker() {
+    while (nextIndex < items.length) {
+      const currentIndex = nextIndex;
+      nextIndex += 1;
+      results[currentIndex] = await mapper(items[currentIndex]);
+    }
+  }
+  await Promise.all(Array.from({ length: Math.min(limit, items.length) }, worker));
+  return results;
+}
+function createReposRouter() {
+  const app = new Hono5();
+  app.get("/", async (c) => {
+    const repos = await c.env.deps.repositories.repoConfigs.listRepoConfigs(c.env);
+    return c.json({ repos });
+  });
+  app.get("/install", async (c) => {
+    try {
+      return c.redirect(await c.env.deps.gitProvider.getAppInstallationUrl(), 302);
+    } catch (error) {
+      c.env.deps.platform.logger.error("Failed to resolve GitHub App installation URL:", error);
+      return jsonError(`Failed to resolve GitHub App installation URL: ${error instanceof Error ? error.message : String(error)}`, 500);
+    }
+  });
+  app.post("/sync", async (c) => {
+    try {
+      const installations = await c.env.deps.gitProvider.listInstallations();
+      const synced = [];
+      const repoConfigs = c.env.deps.repositories.repoConfigs;
+      for (const inst of installations) {
+        const github = c.env.deps.gitProvider.createService(String(inst.id));
+        const repos = await github.listRepositories();
+        const results = await mapWithConcurrency(
+          repos,
+          5,
+          async (repo) => {
+            const owner = repo.owner.login;
+            const name = repo.name;
+            const fullName = `${owner}/${name}`;
+            try {
+              await repoConfigs.syncRepoConfig(c.env, {
+                installationId: String(inst.id),
+                owner,
+                repo: name
+              });
+              return fullName;
+            } catch (repoError) {
+              c.env.deps.platform.logger.error(`Failed to sync repo: ${fullName}`, repoError);
+              return null;
+            }
+          }
+        );
+        const installationSynced = [];
+        for (const res of results) {
+          if (res) {
+            synced.push(res);
+            installationSynced.push(res);
+          }
+        }
+        await repoConfigs.deleteStaleRepoConfigs(c.env, String(inst.id), installationSynced);
+      }
+      return c.json({ ok: true, synced });
+    } catch (error) {
+      c.env.deps.platform.logger.error("Manual sync failed:", error);
+      return jsonError(`Sync failed: ${error instanceof Error ? error.message : String(error)}`, 500);
+    }
+  });
+  app.get("/:owner/:repo/config", async (c) => {
+    const repo = await c.env.deps.repositories.repoConfigs.getRepoConfigRecord(c.env, c.req.param("owner"), c.req.param("repo"));
+    if (!repo) {
+      return jsonError("Repository config not found.", 404);
+    }
+    return c.json({ repo });
+  });
+  app.patch("/:owner/:repo/config", async (c) => {
+    const { owner, repo } = c.req.param();
+    const body = await c.req.json();
+    const parsedPatch = repoConfigPatchSchema.safeParse(body);
+    if (!parsedPatch.success) {
+      return jsonError("Invalid repository config patch.", 400);
+    }
+    const repoConfigs = c.env.deps.repositories.repoConfigs;
+    const existing = await repoConfigs.getRepoConfigRecord(c.env, owner, repo);
+    if (!existing) {
+      return jsonError("Repository config not found.", 404);
+    }
+    const patch = parsedPatch.data;
+    const hasConfigPatch = patch.review !== void 0 || patch.model !== void 0;
+    if (!hasConfigPatch && patch.enabled !== void 0) {
+      await repoConfigs.updateRepoConfigEnabled(c.env, {
+        owner,
+        repo,
+        enabled: patch.enabled
+      });
+      await c.env.deps.config.invalidateRepoConfigCache(owner, repo);
+      return c.json({ ok: true });
+    }
+    const configPatch = {};
+    if (patch.review !== void 0) {
+      configPatch.review = patch.review;
+    }
+    if (patch.model !== void 0) {
+      configPatch.model = patch.model;
+    }
+    const updatedParsedJson = {
+      ...existing.parsedJson,
+      ...configPatch
+    };
+    const parsedConfig = repoConfigSchema.safeParse(updatedParsedJson);
+    if (!parsedConfig.success) {
+      return jsonError("Invalid repository config.", 400);
+    }
+    await repoConfigs.upsertRepoConfig(c.env, {
+      installationId: existing.installationId,
+      owner,
+      repo,
+      parsedJson: parsedConfig.data,
+      enabled: patch.enabled
+    });
+    await c.env.deps.config.invalidateRepoConfigCache(owner, repo);
+    return c.json({ ok: true });
+  });
+  return app;
+}
+
+// src/routes/api/stats.ts
+import { Hono as Hono6 } from "hono";
+function createStatsRouter() {
+  const app = new Hono6();
+  app.get("/", async (c) => {
+    const daysParam = c.req.query("days");
+    const days = daysParam ? parseInt(daysParam, 10) : 30;
+    const timeZone = c.req.query("tz") ?? "UTC";
+    const stats = await c.env.deps.repositories.stats.getStats(c.env, days, timeZone);
+    return c.json({ stats });
+  });
+  return app;
+}
+
+// src/routes/api/models.ts
+import { Hono as Hono7 } from "hono";
+import { z as z3 } from "zod";
+import { llmApiFormats } from "@codraoss/schema";
+var apiFormatSchema = z3.enum(llmApiFormats);
+var positiveIntegerSchema = z3.number().int().positive().finite();
+var modelIdSchema = z3.string().trim().min(1);
+var optionalUrlSchema = z3.string().trim().url().nullable().optional();
+var providerIdSchema = z3.string().uuid();
+var providerCreateSchema = z3.strictObject({
+  name: z3.string().trim().min(1),
+  apiFormat: apiFormatSchema,
+  baseUrl: optionalUrlSchema,
+  apiKey: z3.string().optional(),
+  enabled: z3.boolean().default(true)
+});
+var providerUpdateSchema = providerCreateSchema.extend({
+  clearApiKey: z3.boolean().optional()
+});
+var modelConfigUpdateSchema = z3.strictObject({
+  providerId: providerIdSchema,
+  modelName: z3.string().trim().min(1)
+});
+var globalModelConfigSchema = z3.strictObject({
+  main: modelIdSchema.nullable().default(null),
+  fallbacks: z3.array(modelIdSchema).nullable().default([]),
+  size_overrides: z3.array(
+    z3.strictObject({
+      max_lines: positiveIntegerSchema,
+      model: modelIdSchema,
+      fallbacks: z3.array(modelIdSchema).optional()
+    })
+  ).nullable().optional()
+});
+function requiresExplicitBaseUrl(apiFormat, baseUrl) {
+  return apiFormat === "vertex" && !baseUrl;
+}
+function readModelIdParam(value) {
+  try {
+    return decodeURIComponent(value);
+  } catch {
+    return value;
+  }
+}
+function createModelsRouter() {
+  const app = new Hono7();
+  app.get("/", async (c) => {
+    const modelConfigsRepo = c.env.deps.repositories.modelConfigs;
+    const [providers, configs] = await Promise.all([
+      modelConfigsRepo.listLlmProviders(c.env),
+      modelConfigsRepo.listModelConfigs(c.env)
+    ]);
+    return c.json({ providers, configs });
+  });
+  app.post("/sync", async (c) => {
+    const modelConfigsRepo = c.env.deps.repositories.modelConfigs;
+    const syncErrors = await c.env.deps.modelRunner.syncProviderModelCatalog();
+    const [providers, configs] = await Promise.all([
+      modelConfigsRepo.listLlmProviders(c.env),
+      modelConfigsRepo.listModelConfigs(c.env)
+    ]);
+    return c.json({ providers, configs, syncErrors });
+  });
+  app.get("/global", async (c) => {
+    const config = await c.env.deps.config.getGlobalConfig();
+    return c.json({ config });
+  });
+  app.patch("/global", async (c) => {
+    const body = await c.req.json();
+    const parsed = globalModelConfigSchema.safeParse(body);
+    if (!parsed.success) {
+      return jsonError("Invalid global model config.", 400);
+    }
+    await c.env.deps.config.updateGlobalConfig(parsed.data);
+    return c.json({ ok: true });
+  });
+  app.post("/providers", async (c) => {
+    const parsed = providerCreateSchema.safeParse(await c.req.json());
+    if (!parsed.success) {
+      return jsonError("Invalid provider config.", 400);
+    }
+    const input = parsed.data;
+    if (requiresExplicitBaseUrl(input.apiFormat, input.baseUrl)) {
+      return jsonError("Vertex AI requires a base URL with your GCP project ID and region, e.g. https://us-central1-aiplatform.googleapis.com/v1/projects/YOUR_PROJECT_ID/locations/us-central1", 400);
+    }
+    try {
+      const provider = await c.env.deps.modelRunner.createProviderWithSecret(input);
+      return c.json({ provider }, 201);
+    } catch (error) {
+      const err = error;
+      if (err.isUniqueNameError) {
+        return jsonError(`Provider ${input.name} already exists. Update the existing provider instead.`, 409);
+      }
+      if (err.isEncryptionConfigError) {
+        return jsonError(err.message || "LLM encryption is not configured.", 400);
+      }
+      if (err.isKeyRequiredError) {
+        return jsonError(`Provider ${input.name} needs an API key before it can be enabled.`, 400);
+      }
+      throw error;
+    }
+  });
+  app.patch("/providers/:id", async (c) => {
+    const id = c.req.param("id");
+    if (!providerIdSchema.safeParse(id).success) {
+      return jsonError("Invalid provider id.", 400);
+    }
+    const parsed = providerUpdateSchema.safeParse(await c.req.json());
+    if (!parsed.success) {
+      return jsonError("Invalid provider config.", 400);
+    }
+    const input = parsed.data;
+    if (requiresExplicitBaseUrl(input.apiFormat, input.baseUrl)) {
+      return jsonError("Vertex AI requires a base URL with your GCP project ID and region, e.g. https://us-central1-aiplatform.googleapis.com/v1/projects/YOUR_PROJECT_ID/locations/us-central1", 400);
+    }
+    try {
+      const provider = await c.env.deps.modelRunner.updateProviderWithSecret(id, input);
+      if (!provider) return jsonError("Provider not found.", 404);
+      return c.json({ provider });
+    } catch (error) {
+      const err = error;
+      if (err.isUniqueNameError) {
+        return jsonError(`Provider ${input.name} already exists. Choose a different provider name.`, 409);
+      }
+      if (err.isEncryptionConfigError) {
+        return jsonError(err.message || "LLM encryption is not configured.", 400);
+      }
+      if (err.isKeyRequiredError) {
+        return jsonError(`Provider ${input.name} needs an API key before it can be enabled.`, 400);
+      }
+      throw error;
+    }
+  });
+  app.delete("/providers/:id", async (c) => {
+    const id = c.req.param("id");
+    if (!providerIdSchema.safeParse(id).success) {
+      return jsonError("Invalid provider id.", 400);
+    }
+    const result = await c.env.deps.repositories.modelConfigs.deleteLlmProvider(c.env, id);
+    if (!result.deleted) {
+      return jsonError(result.reason ?? "Provider not found.", result.reason ? 409 : 404);
+    }
+    return c.json({ ok: true });
+  });
+  app.post("/:id/test", async (c) => {
+    const modelId = readModelIdParam(c.req.param("id"));
+    const parsedModelId = modelIdSchema.safeParse(modelId);
+    if (!parsedModelId.success) {
+      return jsonError("Invalid model id.", 400);
+    }
+    try {
+      const response = await c.env.deps.modelRunner.testConnection(parsedModelId.data);
+      return c.json(response);
+    } catch (error) {
+      const err = error;
+      if (err.isNotFoundError) return jsonError("Model not found.", 404);
+      if (err.isDisabledError || err.isMissingKeyError) return jsonError(err.message, 400);
+      return jsonError(
+        err.message || "Connection test failed.",
+        err.status || 502
+      );
+    }
+  });
+  app.post("/:id", async (c) => {
+    const modelId = readModelIdParam(c.req.param("id"));
+    const parsedModelId = modelIdSchema.safeParse(modelId);
+    if (!parsedModelId.success) {
+      return jsonError("Invalid model id.", 400);
+    }
+    const body = await c.req.json();
+    const parsed = modelConfigUpdateSchema.safeParse(body);
+    if (!parsed.success) {
+      return jsonError("Invalid model config.", 400);
+    }
+    const saved = await c.env.deps.repositories.modelConfigs.updateModelConfig(c.env, {
+      modelId: parsedModelId.data,
+      providerId: parsed.data.providerId,
+      modelName: parsed.data.modelName
+    });
+    if (!saved) return jsonError("Provider not found.", 404);
+    return c.json({ ok: true, config: saved });
+  });
+  app.delete("/:id", async (c) => {
+    const modelId = readModelIdParam(c.req.param("id"));
+    const parsedModelId = modelIdSchema.safeParse(modelId);
+    if (!parsedModelId.success) {
+      return jsonError("Invalid model id.", 400);
+    }
+    const deleted = await c.env.deps.repositories.modelConfigs.deleteModelConfig(c.env, parsedModelId.data);
+    if (!deleted) return jsonError("Model not found.", 404);
+    return c.json({ ok: true });
+  });
+  return app;
+}
+
+// src/routes/api/settings.ts
+import { Hono as Hono8 } from "hono";
+import { z as z4 } from "zod";
+import { reviewConcurrencyLevels, reviewMaxCommentsOptions, reviewMaxFilesRange, reviewSettingsSchema } from "@codraoss/schema";
+var reviewSettingsPatchSchema = z4.strictObject({
+  concurrencyLevel: z4.enum(reviewConcurrencyLevels).optional(),
+  maxComments: z4.number().int().refine(
+    (value) => reviewMaxCommentsOptions.includes(value),
+    "Invalid max comments value."
+  ).optional(),
+  maxFiles: z4.number().int().min(reviewMaxFilesRange.min).max(reviewMaxFilesRange.max).optional()
+}).refine(
+  (settings) => Object.values(settings).some((value) => value !== void 0),
+  "At least one setting must be provided."
+);
+function createSettingsRouter() {
+  const app = new Hono8();
+  app.get("/", async (c) => {
+    const settings = await c.env.deps.repositories.appSettings.getReviewSettings(c.env);
+    return c.json({ settings });
+  });
+  app.patch("/", async (c) => {
+    const body = await c.req.json().catch(() => null);
+    const parsed = reviewSettingsPatchSchema.safeParse(body);
+    if (!parsed.success) {
+      return jsonError("Invalid review settings.", 400);
+    }
+    const current = await c.env.deps.repositories.appSettings.getReviewSettings(c.env);
+    const next = reviewSettingsSchema.parse({ ...current, ...parsed.data });
+    await c.env.deps.repositories.appSettings.updateReviewSettings(c.env, next);
+    return c.json({ ok: true, settings: next });
+  });
+  return app;
+}
+
+// src/router.ts
+async function serveIndex(c) {
+  const assetsFetch = c.env.ASSETS?.fetch;
+  if (typeof assetsFetch === "function") {
+    return assetsFetch(new URL("/index.html", c.req.url));
+  }
+  return c.text("Not Found: Please mount UI static assets handler here.", 404);
+}
+function createApiRouter() {
+  const app = new Hono9();
+  app.use("*", observability);
+  app.use("/auth/logout", requireSession);
+  app.use("/auth/logout", requireCsrfHeader);
+  app.route("/auth", createAuthRouter());
+  app.route("/webhook", createWebhookRouter());
+  app.use("/api/*", requireSession);
+  app.use("/api/*", requireCsrfHeader);
+  app.route("/api/auth", createAuthApiRouter());
+  app.route("/api/jobs", createJobsRouter());
+  app.route("/api/repos", createReposRouter());
+  app.route("/api/stats", createStatsRouter());
+  app.route("/api/models", createModelsRouter());
+  app.route("/api/settings", createSettingsRouter());
+  app.get("/login", serveIndex);
+  app.get("/", serveIndex);
+  app.get("/dashboard", requireSession, serveIndex);
+  app.get("/jobs", requireSession, serveIndex);
+  app.get("/jobs/*", requireSession, serveIndex);
+  app.get("/repos", requireSession, serveIndex);
+  app.get("/stats", requireSession, serveIndex);
+  app.get("/health", requireSession, serveIndex);
+  app.get("/settings", requireSession, serveIndex);
+  app.get("/account", requireSession, serveIndex);
+  return app;
+}
+export {
+  createApiRouter
+};
+//# sourceMappingURL=index.js.map