@data-club/ai-hub-server 0.0.1

package/dist/handlers/responses.d.ts

@@ -0,0 +1,46 @@
+/**
+ * Small response helpers used by every handler.
+ *
+ * Centralizing them means error-shape drift can't happen — `unauthorized()`
+ * always emits the same `{ error: { code, message } }` envelope, so the
+ * React client's `AIHubError` reducer stays consistent.
+ *
+ * @see SPECIFICATIONS.md §13.4 — input safety / Zod validation
+ */
+/**
+ * Writes `body` as JSON with the given `status`. Adds `application/json`
+ * content-type automatically.
+ *
+ * @param status - HTTP status code.
+ * @param body - JSON-serializable body.
+ * @param headers - extra headers to merge in.
+ * @returns the Response.
+ */
+export declare function jsonResponse(status: number, body: unknown, headers?: Record<string, string>): Response;
+/**
+ * Standard error envelope. Pairs every error with a stable machine code so
+ * the React client's `AIHubError` discriminator stays useful.
+ *
+ * @param status - HTTP status code.
+ * @param code - machine-readable code matching the §7.5 `AIHubError` codes.
+ * @param message - human-readable description; safe to surface to end-users.
+ * @returns the Response.
+ */
+export declare function errorResponse(status: number, code: string, message: string): Response;
+/** 401 with a generic invalid-credentials envelope (§13.1). */
+export declare function unauthorized(message?: string): Response;
+/** 403 used for role-mismatch + shield + min-count violations (§8.6). */
+export declare function forbidden(message?: string, code?: string): Response;
+/** 400 with a `validation` envelope. */
+export declare function validationError(message: string, code?: string): Response;
+/** 409 used for state-conflict errors (e.g. `theme_switcher_disabled`). */
+export declare function conflictError(code: string, message: string): Response;
+/** 501 used for Step-2 stubs that Step 3+ replaces with real handlers. */
+export declare function notImplemented(message?: string): Response;
+/** 404 with no enumeration leakage — used for unknown paths (§8.6). */
+export declare function notFound(message?: string): Response;
+/** 405 used by the matcher when the path matches but the method doesn't. */
+export declare function methodNotAllowed(message?: string): Response;
+/** 500 for internal-error catch-alls. The body never leaks stack traces. */
+export declare function internalError(message?: string): Response;
+//# sourceMappingURL=responses.d.ts.map

package/dist/handlers/responses.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"responses.d.ts","sourceRoot":"","sources":["../../src/handlers/responses.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAKH;;;;;;;;GAQG;AACH,wBAAgB,YAAY,CAC1B,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,OAAO,EACb,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAC/B,QAAQ,CAQV;AAED;;;;;;;;GAQG;AACH,wBAAgB,aAAa,CAC3B,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,MAAM,GACd,QAAQ,CAEV;AAED,+DAA+D;AAC/D,wBAAgB,YAAY,CAAC,OAAO,SAAwB,GAAG,QAAQ,CAEtE;AAED,yEAAyE;AACzE,wBAAgB,SAAS,CACvB,OAAO,SAAc,EACrB,IAAI,SAAc,GACjB,QAAQ,CAEV;AAED,wCAAwC;AACxC,wBAAgB,eAAe,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,SAAe,GAAG,QAAQ,CAE9E;AAED,2EAA2E;AAC3E,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,QAAQ,CAErE;AAED,0EAA0E;AAC1E,wBAAgB,cAAc,CAAC,OAAO,SAAoB,GAAG,QAAQ,CAEpE;AAED,uEAAuE;AACvE,wBAAgB,QAAQ,CAAC,OAAO,SAAc,GAAG,QAAQ,CAExD;AAED,4EAA4E;AAC5E,wBAAgB,gBAAgB,CAAC,OAAO,SAAuB,GAAG,QAAQ,CAEzE;AAED,4EAA4E;AAC5E,wBAAgB,aAAa,CAAC,OAAO,SAA0B,GAAG,QAAQ,CAEzE"}

package/dist/handlers/responses.js

@@ -0,0 +1,74 @@
+/**
+ * Small response helpers used by every handler.
+ *
+ * Centralizing them means error-shape drift can't happen — `unauthorized()`
+ * always emits the same `{ error: { code, message } }` envelope, so the
+ * React client's `AIHubError` reducer stays consistent.
+ *
+ * @see SPECIFICATIONS.md §13.4 — input safety / Zod validation
+ */
+/** Default JSON content-type with utf-8 charset. */
+const JSON_CONTENT_TYPE = "application/json; charset=utf-8";
+/**
+ * Writes `body` as JSON with the given `status`. Adds `application/json`
+ * content-type automatically.
+ *
+ * @param status - HTTP status code.
+ * @param body - JSON-serializable body.
+ * @param headers - extra headers to merge in.
+ * @returns the Response.
+ */
+export function jsonResponse(status, body, headers) {
+    return new Response(JSON.stringify(body), {
+        status,
+        headers: {
+            "Content-Type": JSON_CONTENT_TYPE,
+            ...(headers ?? {}),
+        },
+    });
+}
+/**
+ * Standard error envelope. Pairs every error with a stable machine code so
+ * the React client's `AIHubError` discriminator stays useful.
+ *
+ * @param status - HTTP status code.
+ * @param code - machine-readable code matching the §7.5 `AIHubError` codes.
+ * @param message - human-readable description; safe to surface to end-users.
+ * @returns the Response.
+ */
+export function errorResponse(status, code, message) {
+    return jsonResponse(status, { error: { code, message } });
+}
+/** 401 with a generic invalid-credentials envelope (§13.1). */
+export function unauthorized(message = "Invalid credentials") {
+    return errorResponse(401, "unauthorized", message);
+}
+/** 403 used for role-mismatch + shield + min-count violations (§8.6). */
+export function forbidden(message = "Forbidden", code = "forbidden") {
+    return errorResponse(403, code, message);
+}
+/** 400 with a `validation` envelope. */
+export function validationError(message, code = "validation") {
+    return errorResponse(400, code, message);
+}
+/** 409 used for state-conflict errors (e.g. `theme_switcher_disabled`). */
+export function conflictError(code, message) {
+    return errorResponse(409, code, message);
+}
+/** 501 used for Step-2 stubs that Step 3+ replaces with real handlers. */
+export function notImplemented(message = "Not implemented") {
+    return errorResponse(501, "not_implemented", message);
+}
+/** 404 with no enumeration leakage — used for unknown paths (§8.6). */
+export function notFound(message = "Not found") {
+    return errorResponse(404, "not_found", message);
+}
+/** 405 used by the matcher when the path matches but the method doesn't. */
+export function methodNotAllowed(message = "Method not allowed") {
+    return errorResponse(405, "method_not_allowed", message);
+}
+/** 500 for internal-error catch-alls. The body never leaks stack traces. */
+export function internalError(message = "Internal server error") {
+    return errorResponse(500, "internal", message);
+}
+//# sourceMappingURL=responses.js.map

package/dist/handlers/responses.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"responses.js","sourceRoot":"","sources":["../../src/handlers/responses.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,oDAAoD;AACpD,MAAM,iBAAiB,GAAG,iCAAiC,CAAC;AAE5D;;;;;;;;GAQG;AACH,MAAM,UAAU,YAAY,CAC1B,MAAc,EACd,IAAa,EACb,OAAgC;IAEhC,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE;QACxC,MAAM;QACN,OAAO,EAAE;YACP,cAAc,EAAE,iBAAiB;YACjC,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC;SACnB;KACF,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,aAAa,CAC3B,MAAc,EACd,IAAY,EACZ,OAAe;IAEf,OAAO,YAAY,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,CAAC,CAAC;AAC5D,CAAC;AAED,+DAA+D;AAC/D,MAAM,UAAU,YAAY,CAAC,OAAO,GAAG,qBAAqB;IAC1D,OAAO,aAAa,CAAC,GAAG,EAAE,cAAc,EAAE,OAAO,CAAC,CAAC;AACrD,CAAC;AAED,yEAAyE;AACzE,MAAM,UAAU,SAAS,CACvB,OAAO,GAAG,WAAW,EACrB,IAAI,GAAG,WAAW;IAElB,OAAO,aAAa,CAAC,GAAG,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;AAC3C,CAAC;AAED,wCAAwC;AACxC,MAAM,UAAU,eAAe,CAAC,OAAe,EAAE,IAAI,GAAG,YAAY;IAClE,OAAO,aAAa,CAAC,GAAG,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;AAC3C,CAAC;AAED,2EAA2E;AAC3E,MAAM,UAAU,aAAa,CAAC,IAAY,EAAE,OAAe;IACzD,OAAO,aAAa,CAAC,GAAG,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;AAC3C,CAAC;AAED,0EAA0E;AAC1E,MAAM,UAAU,cAAc,CAAC,OAAO,GAAG,iBAAiB;IACxD,OAAO,aAAa,CAAC,GAAG,EAAE,iBAAiB,EAAE,OAAO,CAAC,CAAC;AACxD,CAAC;AAED,uEAAuE;AACvE,MAAM,UAAU,QAAQ,CAAC,OAAO,GAAG,WAAW;IAC5C,OAAO,aAAa,CAAC,GAAG,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC;AAClD,CAAC;AAED,4EAA4E;AAC5E,MAAM,UAAU,gBAAgB,CAAC,OAAO,GAAG,oBAAoB;IAC7D,OAAO,aAAa,CAAC,GAAG,EAAE,oBAAoB,EAAE,OAAO,CAAC,CAAC;AAC3D,CAAC;AAED,4EAA4E;AAC5E,MAAM,UAAU,aAAa,CAAC,OAAO,GAAG,uBAAuB;IAC7D,OAAO,aAAa,CAAC,GAAG,EAAE,UAAU,EAAE,OAAO,CAAC,CAAC;AACjD,CAAC"}

package/dist/handlers/routeTable.d.ts

@@ -0,0 +1,21 @@
+/**
+ * Canonical route table.
+ *
+ * Order matters — the matcher walks top-to-bottom and returns the first
+ * pattern that matches. Concrete paths come before any future wildcards.
+ *
+ * Entries are paired with the step that wires the real handler. After Step 5
+ * every endpoint is real; no stubs remain.
+ *
+ * @see SPECIFICATIONS.md §6.3 — API surface
+ * @see docs/IMPLEMENTATION_PLAN.md — per-endpoint step assignment
+ */
+import type { RouteEntry } from "./types.js";
+/**
+ * Reads as the canonical Step-5 surface in one place. Step 6 adds no new
+ * routes — it extends the chat path with TPM-recovery internals.
+ *
+ * @returns the immutable route table.
+ */
+export declare function buildRouteTable(): ReadonlyArray<RouteEntry>;
+//# sourceMappingURL=routeTable.d.ts.map

package/dist/handlers/routeTable.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"routeTable.d.ts","sourceRoot":"","sources":["../../src/handlers/routeTable.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AA6DH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAE7C;;;;;GAKG;AACH,wBAAgB,eAAe,IAAI,aAAa,CAAC,UAAU,CAAC,CA2G3D"}

package/dist/handlers/routeTable.js

@@ -0,0 +1,133 @@
+/**
+ * Canonical route table.
+ *
+ * Order matters — the matcher walks top-to-bottom and returns the first
+ * pattern that matches. Concrete paths come before any future wildcards.
+ *
+ * Entries are paired with the step that wires the real handler. After Step 5
+ * every endpoint is real; no stubs remain.
+ *
+ * @see SPECIFICATIONS.md §6.3 — API surface
+ * @see docs/IMPLEMENTATION_PLAN.md — per-endpoint step assignment
+ */
+import { handleListAgents as handleListAgentsUser } from "../routes/agents.js";
+import { handleGetPublicFeatureToggles } from "../routes/featureToggles.js";
+import { handleCreateAgent, handleListAgents as handleListAgentsAdmin, handlePatchAgent, } from "../routes/admin/agents.js";
+import { handleListSessionsOverview, handlePurgeAdminSessionSandbox, } from "../routes/admin/sessions.js";
+import { handleCreateRotatingMessage, handleListRotatingMessages, handlePatchRotatingMessage, handleRotateRotatingMessageNow, } from "../routes/admin/rotatingMessages.js";
+import { handleGetFeatureToggles, handleGetSettings, handlePatchFeatureToggles, handlePatchSettings, handleRotateMetricsToken, handleRotateSigningKey, } from "../routes/admin/settings.js";
+import { handleCreateUser, handleDeleteUser, handleListUsers, handlePatchUserRole, handleResetUserPassword, } from "../routes/admin/users.js";
+import { handleChangePassword, handleLogin, handleLogout, handleMe, handleMePreferences, } from "../routes/auth.js";
+import { handleHealth, handleHealthReady } from "../routes/health.js";
+import { handleMetrics } from "../routes/metrics.js";
+import { handleGetChatEvents, handlePostChat, handlePostChatCancel, } from "../routes/chat.js";
+import { handleAdminGetSessionMessages, handleCreateSession, handleDeleteMessageOverride, handleGetSession, handleGetSessionMessages, handleListMessageOverrides, handleListSessions, handlePatchSession, handlePatchSessionReasoning, handlePutMessageOverride, } from "../routes/sessions.js";
+/**
+ * Reads as the canonical Step-5 surface in one place. Step 6 adds no new
+ * routes — it extends the chat path with TPM-recovery internals.
+ *
+ * @returns the immutable route table.
+ */
+export function buildRouteTable() {
+    return [
+        // Health probes — public.
+        { method: "GET", path: "/health", handler: handleHealth },
+        { method: "GET", path: "/health/ready", handler: handleHealthReady },
+        // Auth — full surface after Step 3.
+        { method: "POST", path: "/auth/login", handler: handleLogin },
+        { method: "POST", path: "/auth/change-password", handler: handleChangePassword },
+        { method: "POST", path: "/auth/logout", handler: handleLogout },
+        { method: "GET", path: "/auth/me", handler: handleMe },
+        { method: "PATCH", path: "/auth/me/preferences", handler: handleMePreferences },
+        // Public — Step 10 (deployment-wide UI feature toggles per §8.4).
+        { method: "GET", path: "/feature-toggles", handler: handleGetPublicFeatureToggles },
+        // User-facing — Step 4.
+        { method: "GET", path: "/agents", handler: handleListAgentsUser },
+        { method: "GET", path: "/sessions", handler: handleListSessions },
+        { method: "POST", path: "/sessions", handler: handleCreateSession },
+        { method: "GET", path: "/sessions/:id", handler: handleGetSession },
+        { method: "PATCH", path: "/sessions/:id", handler: handlePatchSession },
+        {
+            method: "PATCH",
+            path: "/sessions/:id/reasoning",
+            handler: handlePatchSessionReasoning,
+        },
+        { method: "GET", path: "/sessions/:id/messages", handler: handleGetSessionMessages },
+        {
+            method: "GET",
+            path: "/sessions/:id/message-overrides",
+            handler: handleListMessageOverrides,
+        },
+        {
+            method: "PUT",
+            path: "/sessions/:id/message-overrides/:position",
+            handler: handlePutMessageOverride,
+        },
+        {
+            method: "DELETE",
+            path: "/sessions/:id/message-overrides/:position",
+            handler: handleDeleteMessageOverride,
+        },
+        // Chat — Step 5 (SSE wire protocol per §9).
+        { method: "POST", path: "/chat", handler: handlePostChat },
+        { method: "GET", path: "/chat/:turn_id/events", handler: handleGetChatEvents },
+        { method: "POST", path: "/chat/:turn_id/cancel", handler: handlePostChatCancel },
+        // Admin — Step 4.
+        { method: "GET", path: "/admin/users", handler: handleListUsers },
+        { method: "POST", path: "/admin/users", handler: handleCreateUser },
+        { method: "PATCH", path: "/admin/users/:id/role", handler: handlePatchUserRole },
+        { method: "POST", path: "/admin/users/:id/reset-password", handler: handleResetUserPassword },
+        { method: "DELETE", path: "/admin/users/:id", handler: handleDeleteUser },
+        { method: "GET", path: "/admin/agents", handler: handleListAgentsAdmin },
+        { method: "POST", path: "/admin/agents", handler: handleCreateAgent },
+        { method: "PATCH", path: "/admin/agents/:id", handler: handlePatchAgent },
+        {
+            method: "GET",
+            path: "/admin/rotating-messages",
+            handler: handleListRotatingMessages,
+        },
+        {
+            method: "POST",
+            path: "/admin/rotating-messages",
+            handler: handleCreateRotatingMessage,
+        },
+        {
+            method: "PATCH",
+            path: "/admin/rotating-messages/:id",
+            handler: handlePatchRotatingMessage,
+        },
+        {
+            method: "POST",
+            path: "/admin/rotating-messages/:id/rotate-now",
+            handler: handleRotateRotatingMessageNow,
+        },
+        { method: "GET", path: "/admin/sessions", handler: handleListSessionsOverview },
+        {
+            method: "GET",
+            path: "/admin/sessions/:id/messages",
+            handler: handleAdminGetSessionMessages,
+        },
+        {
+            method: "POST",
+            path: "/admin/sessions/:id/purge-sandbox",
+            handler: handlePurgeAdminSessionSandbox,
+        },
+        { method: "GET", path: "/admin/settings", handler: handleGetSettings },
+        { method: "PATCH", path: "/admin/settings", handler: handlePatchSettings },
+        { method: "GET", path: "/admin/settings/feature-toggles", handler: handleGetFeatureToggles },
+        { method: "PATCH", path: "/admin/settings/feature-toggles", handler: handlePatchFeatureToggles },
+        {
+            method: "POST",
+            path: "/admin/settings/rotate-signing-key",
+            handler: handleRotateSigningKey,
+        },
+        {
+            method: "POST",
+            path: "/admin/settings/rotate-metrics-token",
+            handler: handleRotateMetricsToken,
+        },
+        // Metrics — Step 4 (bearer-token-gated, no JWT).
+        { method: "GET", path: "/metrics", handler: handleMetrics },
+    ];
+}
+//# sourceMappingURL=routeTable.js.map

package/dist/handlers/routeTable.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"routeTable.js","sourceRoot":"","sources":["../../src/handlers/routeTable.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,gBAAgB,IAAI,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAC/E,OAAO,EAAE,6BAA6B,EAAE,MAAM,6BAA6B,CAAC;AAC5E,OAAO,EACL,iBAAiB,EACjB,gBAAgB,IAAI,qBAAqB,EACzC,gBAAgB,GACjB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EACL,0BAA0B,EAC1B,8BAA8B,GAC/B,MAAM,6BAA6B,CAAC;AACrC,OAAO,EACL,2BAA2B,EAC3B,0BAA0B,EAC1B,0BAA0B,EAC1B,8BAA8B,GAC/B,MAAM,qCAAqC,CAAC;AAC7C,OAAO,EACL,uBAAuB,EACvB,iBAAiB,EACjB,yBAAyB,EACzB,mBAAmB,EACnB,wBAAwB,EACxB,sBAAsB,GACvB,MAAM,6BAA6B,CAAC;AACrC,OAAO,EACL,gBAAgB,EAChB,gBAAgB,EAChB,eAAe,EACf,mBAAmB,EACnB,uBAAuB,GACxB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EACL,oBAAoB,EACpB,WAAW,EACX,YAAY,EACZ,QAAQ,EACR,mBAAmB,GACpB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,YAAY,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AACtE,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,EACL,mBAAmB,EACnB,cAAc,EACd,oBAAoB,GACrB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,6BAA6B,EAC7B,mBAAmB,EACnB,2BAA2B,EAC3B,gBAAgB,EAChB,wBAAwB,EACxB,0BAA0B,EAC1B,kBAAkB,EAClB,kBAAkB,EAClB,2BAA2B,EAC3B,wBAAwB,GACzB,MAAM,uBAAuB,CAAC;AAI/B;;;;;GAKG;AACH,MAAM,UAAU,eAAe;IAC7B,OAAO;QACL,0BAA0B;QAC1B,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,YAAY,EAAE;QACzD,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,iBAAiB,EAAE;QAEpE,oCAAoC;QACpC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,aAAa,EAAE,OAAO,EAAE,WAAW,EAAE;QAC7D,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,uBAAuB,EAAE,OAAO,EAAE,oBAAoB,EAAE;QAChF,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,cAAc,EAAE,OAAO,EAAE,YAAY,EAAE;QAC/D,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,QAAQ,EAAE;QACtD,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,sBAAsB,EAAE,OAAO,EAAE,mBAAmB,EAAE;QAE/E,kEAAkE;QAClE,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,kBAAkB,EAAE,OAAO,EAAE,6BAA6B,EAAE;QAEnF,wBAAwB;QACxB,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,oBAAoB,EAAE;QACjE,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,kBAAkB,EAAE;QACjE,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,mBAAmB,EAAE;QACnE,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,gBAAgB,EAAE;QACnE,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,kBAAkB,EAAE;QACvE;YACE,MAAM,EAAE,OAAO;YACf,IAAI,EAAE,yBAAyB;YAC/B,OAAO,EAAE,2BAA2B;SACrC;QACD,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,wBAAwB,EAAE,OAAO,EAAE,wBAAwB,EAAE;QACpF;YACE,MAAM,EAAE,KAAK;YACb,IAAI,EAAE,iCAAiC;YACvC,OAAO,EAAE,0BAA0B;SACpC;QACD;YACE,MAAM,EAAE,KAAK;YACb,IAAI,EAAE,2CAA2C;YACjD,OAAO,EAAE,wBAAwB;SAClC;QACD;YACE,MAAM,EAAE,QAAQ;YAChB,IAAI,EAAE,2CAA2C;YACjD,OAAO,EAAE,2BAA2B;SACrC;QAED,4CAA4C;QAC5C,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,cAAc,EAAE;QAC1D,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,uBAAuB,EAAE,OAAO,EAAE,mBAAmB,EAAE;QAC9E,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,uBAAuB,EAAE,OAAO,EAAE,oBAAoB,EAAE;QAEhF,kBAAkB;QAClB,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,cAAc,EAAE,OAAO,EAAE,eAAe,EAAE;QACjE,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,cAAc,EAAE,OAAO,EAAE,gBAAgB,EAAE;QACnE,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,uBAAuB,EAAE,OAAO,EAAE,mBAAmB,EAAE;QAChF,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,iCAAiC,EAAE,OAAO,EAAE,uBAAuB,EAAE;QAC7F,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,kBAAkB,EAAE,OAAO,EAAE,gBAAgB,EAAE;QACzE,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,qBAAqB,EAAE;QACxE,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,iBAAiB,EAAE;QACrE,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,mBAAmB,EAAE,OAAO,EAAE,gBAAgB,EAAE;QACzE;YACE,MAAM,EAAE,KAAK;YACb,IAAI,EAAE,0BAA0B;YAChC,OAAO,EAAE,0BAA0B;SACpC;QACD;YACE,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,0BAA0B;YAChC,OAAO,EAAE,2BAA2B;SACrC;QACD;YACE,MAAM,EAAE,OAAO;YACf,IAAI,EAAE,8BAA8B;YACpC,OAAO,EAAE,0BAA0B;SACpC;QACD;YACE,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,yCAAyC;YAC/C,OAAO,EAAE,8BAA8B;SACxC;QACD,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,iBAAiB,EAAE,OAAO,EAAE,0BAA0B,EAAE;QAC/E;YACE,MAAM,EAAE,KAAK;YACb,IAAI,EAAE,8BAA8B;YACpC,OAAO,EAAE,6BAA6B;SACvC;QACD;YACE,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,mCAAmC;YACzC,OAAO,EAAE,8BAA8B;SACxC;QACD,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,iBAAiB,EAAE,OAAO,EAAE,iBAAiB,EAAE;QACtE,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,iBAAiB,EAAE,OAAO,EAAE,mBAAmB,EAAE;QAC1E,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,iCAAiC,EAAE,OAAO,EAAE,uBAAuB,EAAE;QAC5F,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,iCAAiC,EAAE,OAAO,EAAE,yBAAyB,EAAE;QAChG;YACE,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,oCAAoC;YAC1C,OAAO,EAAE,sBAAsB;SAChC;QACD;YACE,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,sCAAsC;YAC5C,OAAO,EAAE,wBAAwB;SAClC;QAED,iDAAiD;QACjD,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,aAAa,EAAE;KAC5D,CAAC;AACJ,CAAC"}

package/dist/handlers/router.d.ts

@@ -0,0 +1,37 @@
+/**
+ * Tiny path + method matcher.
+ *
+ * Lives in-package — we explicitly do NOT depend on Hono / Express /
+ * Fastify (§6.2). The route table is flat, the patterns are simple, and a
+ * 50-line matcher beats a 500 KB framework runtime that brings its own
+ * plugin ecosystem we wouldn't use.
+ *
+ * Pattern syntax: `/sessions/:id` matches `/sessions/abc` and exposes
+ * `{ id: "abc" }` as the parameter map. The matcher does not support globs
+ * or regex — every spec'd route is a plain segment-by-segment match.
+ *
+ * The `*` method is the wildcard used by `OPTIONS` preflight handlers and
+ * the catch-all 404. First-registered-first-matched, so wildcards always go
+ * at the bottom of the table.
+ *
+ * @see SPECIFICATIONS.md §6.2 — stack (no framework runtime)
+ */
+import type { RouteEntry } from "./types.js";
+/** A successful match's output. */
+export interface MatchResult {
+    /** The handler to invoke. */
+    entry: RouteEntry;
+    /** Path-parameter map (e.g. `{ id: "abc" }`). */
+    params: Record<string, string>;
+}
+/**
+ * Walks `entries` in order and returns the first one whose method + path
+ * pattern match `method` and `pathname`. Returns `null` if nothing matches.
+ *
+ * @param entries - the route table.
+ * @param method - request method (uppercased).
+ * @param pathname - request path with the basePath already stripped.
+ * @returns the matched entry + params, or `null`.
+ */
+export declare function matchRoute(entries: ReadonlyArray<RouteEntry>, method: string, pathname: string): MatchResult | null;
+//# sourceMappingURL=router.d.ts.map

package/dist/handlers/router.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"router.d.ts","sourceRoot":"","sources":["../../src/handlers/router.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAE7C,mCAAmC;AACnC,MAAM,WAAW,WAAW;IAC1B,6BAA6B;IAC7B,KAAK,EAAE,UAAU,CAAC;IAClB,iDAAiD;IACjD,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAChC;AAED;;;;;;;;GAQG;AACH,wBAAgB,UAAU,CACxB,OAAO,EAAE,aAAa,CAAC,UAAU,CAAC,EAClC,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,MAAM,GACf,WAAW,GAAG,IAAI,CAOpB"}

package/dist/handlers/router.js

@@ -0,0 +1,82 @@
+/**
+ * Tiny path + method matcher.
+ *
+ * Lives in-package — we explicitly do NOT depend on Hono / Express /
+ * Fastify (§6.2). The route table is flat, the patterns are simple, and a
+ * 50-line matcher beats a 500 KB framework runtime that brings its own
+ * plugin ecosystem we wouldn't use.
+ *
+ * Pattern syntax: `/sessions/:id` matches `/sessions/abc` and exposes
+ * `{ id: "abc" }` as the parameter map. The matcher does not support globs
+ * or regex — every spec'd route is a plain segment-by-segment match.
+ *
+ * The `*` method is the wildcard used by `OPTIONS` preflight handlers and
+ * the catch-all 404. First-registered-first-matched, so wildcards always go
+ * at the bottom of the table.
+ *
+ * @see SPECIFICATIONS.md §6.2 — stack (no framework runtime)
+ */
+/**
+ * Walks `entries` in order and returns the first one whose method + path
+ * pattern match `method` and `pathname`. Returns `null` if nothing matches.
+ *
+ * @param entries - the route table.
+ * @param method - request method (uppercased).
+ * @param pathname - request path with the basePath already stripped.
+ * @returns the matched entry + params, or `null`.
+ */
+export function matchRoute(entries, method, pathname) {
+    for (const entry of entries) {
+        if (entry.method !== "*" && entry.method !== method)
+            continue;
+        const params = matchPath(entry.path, pathname);
+        if (params)
+            return { entry, params };
+    }
+    return null;
+}
+/**
+ * Compares a path template (with `:param` placeholders) against an actual
+ * pathname. Returns the parameter map on a match, `null` otherwise.
+ *
+ * Trailing slashes are tolerated — `/foo/` matches `/foo`.
+ *
+ * @param template - the route template (e.g. `/sessions/:id`).
+ * @param pathname - the actual path being matched.
+ * @returns parameter map on a match, else `null`.
+ */
+function matchPath(template, pathname) {
+    const tplParts = trimSlashes(template).split("/");
+    const pathParts = trimSlashes(pathname).split("/");
+    if (tplParts.length !== pathParts.length)
+        return null;
+    const params = {};
+    for (let i = 0; i < tplParts.length; i++) {
+        const tp = tplParts[i];
+        const pp = pathParts[i];
+        if (tp.startsWith(":")) {
+            const name = tp.slice(1);
+            params[name] = decodeURIComponent(pp);
+            continue;
+        }
+        if (tp !== pp)
+            return null;
+    }
+    return params;
+}
+/**
+ * Trims a single leading and trailing `/` so `split("/")` yields the same
+ * segment count regardless of slash style.
+ *
+ * @param s - the path or template string.
+ * @returns the input with one leading/trailing slash removed.
+ */
+function trimSlashes(s) {
+    let out = s;
+    if (out.startsWith("/"))
+        out = out.slice(1);
+    if (out.endsWith("/"))
+        out = out.slice(0, -1);
+    return out;
+}
+//# sourceMappingURL=router.js.map

package/dist/handlers/router.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"router.js","sourceRoot":"","sources":["../../src/handlers/router.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAYH;;;;;;;;GAQG;AACH,MAAM,UAAU,UAAU,CACxB,OAAkC,EAClC,MAAc,EACd,QAAgB;IAEhB,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,IAAI,KAAK,CAAC,MAAM,KAAK,GAAG,IAAI,KAAK,CAAC,MAAM,KAAK,MAAM;YAAE,SAAS;QAC9D,MAAM,MAAM,GAAG,SAAS,CAAC,KAAK,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;QAC/C,IAAI,MAAM;YAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;IACvC,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;;GASG;AACH,SAAS,SAAS,CAChB,QAAgB,EAChB,QAAgB;IAEhB,MAAM,QAAQ,GAAG,WAAW,CAAC,QAAQ,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAClD,MAAM,SAAS,GAAG,WAAW,CAAC,QAAQ,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACnD,IAAI,QAAQ,CAAC,MAAM,KAAK,SAAS,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IAEtD,MAAM,MAAM,GAA2B,EAAE,CAAC;IAC1C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,QAAQ,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACzC,MAAM,EAAE,GAAG,QAAQ,CAAC,CAAC,CAAW,CAAC;QACjC,MAAM,EAAE,GAAG,SAAS,CAAC,CAAC,CAAW,CAAC;QAClC,IAAI,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YACvB,MAAM,IAAI,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YACzB,MAAM,CAAC,IAAI,CAAC,GAAG,kBAAkB,CAAC,EAAE,CAAC,CAAC;YACtC,SAAS;QACX,CAAC;QACD,IAAI,EAAE,KAAK,EAAE;YAAE,OAAO,IAAI,CAAC;IAC7B,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;;GAMG;AACH,SAAS,WAAW,CAAC,CAAS;IAC5B,IAAI,GAAG,GAAG,CAAC,CAAC;IACZ,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAC5C,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAC9C,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/handlers/sse.d.ts

@@ -0,0 +1,38 @@
+/**
+ * Small SSE writer helpers.
+ *
+ * The chat handler builds a `ReadableStream` of bytes and pipes named
+ * events into it. This file holds the encoding (utf-8 + `event:`/`data:`
+ * lines) and a `formatSseEvent` helper so the writer stays in one place.
+ *
+ * @see SPECIFICATIONS.md §9.5 — why SSE (not EventSource)
+ */
+import type { AIHubEvent } from "@data-club/ai-hub";
+/**
+ * Formats one ai-hub event into the byte payload an SSE client expects.
+ *
+ * Format per the W3C EventSource spec:
+ *
+ * ```
+ * event: <event-name>
+ * data: <json-payload>
+ *
+ * ```
+ *
+ * The blank line separator is required. Multi-line payloads get one
+ * `data:` line per newline; we shouldn't see any in practice (the events
+ * we emit are flat JSON), but the helper handles it defensively.
+ *
+ * @param event - the ai-hub event.
+ * @returns the SSE-formatted bytes.
+ */
+export declare function formatSseEvent(event: AIHubEvent): Uint8Array;
+/**
+ * Formats a plain SSE comment-line (used for heartbeats). Browsers and
+ * proxies treat any line starting with `:` as a comment — keeps the
+ * connection alive without delivering an event to the consumer.
+ *
+ * @returns the bytes of a `:hb\n\n` heartbeat.
+ */
+export declare function formatSseHeartbeat(): Uint8Array;
+//# sourceMappingURL=sse.d.ts.map

package/dist/handlers/sse.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sse.d.ts","sourceRoot":"","sources":["../../src/handlers/sse.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAEpD;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,UAAU,GAAG,UAAU,CAa5D;AAED;;;;;;GAMG;AACH,wBAAgB,kBAAkB,IAAI,UAAU,CAE/C"}

package/dist/handlers/sse.js

@@ -0,0 +1,52 @@
+/**
+ * Small SSE writer helpers.
+ *
+ * The chat handler builds a `ReadableStream` of bytes and pipes named
+ * events into it. This file holds the encoding (utf-8 + `event:`/`data:`
+ * lines) and a `formatSseEvent` helper so the writer stays in one place.
+ *
+ * @see SPECIFICATIONS.md §9.5 — why SSE (not EventSource)
+ */
+/**
+ * Formats one ai-hub event into the byte payload an SSE client expects.
+ *
+ * Format per the W3C EventSource spec:
+ *
+ * ```
+ * event: <event-name>
+ * data: <json-payload>
+ *
+ * ```
+ *
+ * The blank line separator is required. Multi-line payloads get one
+ * `data:` line per newline; we shouldn't see any in practice (the events
+ * we emit are flat JSON), but the helper handles it defensively.
+ *
+ * @param event - the ai-hub event.
+ * @returns the SSE-formatted bytes.
+ */
+export function formatSseEvent(event) {
+    // `heartbeat` events carry no `data` per the wire-protocol union — for
+    // every other variant `data` is present. We pull it out with a narrowing
+    // `in` check so we don't include `data: undefined` in the wire payload
+    // when there's nothing to send.
+    const payload = JSON.stringify({
+        seq: event.seq,
+        ...("data" in event ? { data: event.data } : {}),
+        state: event.state,
+    });
+    const dataLines = payload.split("\n").map((l) => `data: ${l}`).join("\n");
+    const text = `event: ${event.event}\n${dataLines}\n\n`;
+    return new TextEncoder().encode(text);
+}
+/**
+ * Formats a plain SSE comment-line (used for heartbeats). Browsers and
+ * proxies treat any line starting with `:` as a comment — keeps the
+ * connection alive without delivering an event to the consumer.
+ *
+ * @returns the bytes of a `:hb\n\n` heartbeat.
+ */
+export function formatSseHeartbeat() {
+    return new TextEncoder().encode(":hb\n\n");
+}
+//# sourceMappingURL=sse.js.map

package/dist/handlers/sse.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sse.js","sourceRoot":"","sources":["../../src/handlers/sse.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAIH;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,cAAc,CAAC,KAAiB;IAC9C,uEAAuE;IACvE,yEAAyE;IACzE,uEAAuE;IACvE,gCAAgC;IAChC,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC;QAC7B,GAAG,EAAE,KAAK,CAAC,GAAG;QACd,GAAG,CAAC,MAAM,IAAI,KAAK,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAChD,KAAK,EAAE,KAAK,CAAC,KAAK;KACnB,CAAC,CAAC;IACH,MAAM,SAAS,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC1E,MAAM,IAAI,GAAG,UAAU,KAAK,CAAC,KAAK,KAAK,SAAS,MAAM,CAAC;IACvD,OAAO,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;AACxC,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,kBAAkB;IAChC,OAAO,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;AAC7C,CAAC"}

package/dist/handlers/types.d.ts

@@ -0,0 +1,96 @@
+/**
+ * Shared types for the Fetch routing core.
+ *
+ * `AIHubServerContext` is the per-server-instance bundle: DB, logger, parsed
+ * encryption key, route prefix. Subsequent steps extend it (Letta client,
+ * mock-Letta toggle, etc.) — additions are additive.
+ *
+ * Handlers are Web-Standard `(Request, ctx) => Promise<Response>` per §6.2.
+ * No framework runtime, no plugin ecosystem.
+ *
+ * @see SPECIFICATIONS.md §6.2 — stack
+ */
+import type Database from "better-sqlite3";
+import type { DrizzleDB } from "../db/connection.js";
+import type { LettaClient } from "../letta/client.js";
+import type { SubprocessThrottle } from "../letta/subprocessThrottle.js";
+import type { Logger } from "../observability/logger.js";
+/** Per-server-instance context wired by `createFetchHandler`. */
+export interface AIHubServerContext {
+    /** Drizzle client typed against the schema — call this for typed queries. */
+    db: DrizzleDB;
+    /** Raw better-sqlite3 handle — used only for `transaction()` + low-level ops. */
+    sqlite: Database.Database;
+    /** Pino logger with redaction applied. */
+    logger: Logger;
+    /** Parsed `AI_HUB_ENCRYPTION_KEY` (32 bytes). */
+    encryptionKey: Buffer;
+    /**
+     * The route prefix (default `/api/ai-hub`). The matcher peels this off
+     * before pattern-matching. Set via `createFetchHandler({ basePath })`.
+     */
+    basePath: string;
+    /**
+     * Project-shaped Letta client (§6.4). The handler imports types from
+     * `letta/client.ts` and calls this for every Letta interaction —
+     * **never raw HTTP**. Tests inject a mock via
+     * `createFetchHandler({ lettaClient })`.
+     */
+    lettaClient: LettaClient;
+    /**
+     * Per-process throttle that gates Letta Code subprocess spawning. The chat
+     * route's `streamUserMessage` path calls `acquire()` before spawning and
+     * `release()` in the finally; if acquire throws `ServerOverloadedError`
+     * the route returns HTTP 503 with an `error {server_overloaded}` SSE
+     * event. The throttle is per-server-instance (the live-count counter is
+     * in-memory) and is constructed once in `createFetchHandler` from env-
+     * derived config. Tests can inject a configured-for-the-test instance.
+     *
+     * @see ../letta/subprocessThrottle.ts
+     */
+    subprocessThrottle: SubprocessThrottle;
+    /**
+     * Env-var record used as the fallback source for the Letta API key when
+     * the `admin_setting.letta_api_key_encrypted` column is empty (see
+     * `letta/client.ts:resolveApiKey` for the precedence). Production passes
+     * `process.env`; tests pass the synthesized record they boot with so
+     * the fallback behavior is exercisable without touching the real
+     * environment.
+     */
+    envSource: Record<string, string | undefined>;
+    /**
+     * Step-12.5 — absolute base directory holding `seeds/` and `sandboxes/`.
+     * Resolved once by `resolveFilesDir(env)` at boot from
+     * `AI_HUB_FILES_DIR` (or the `${AI_HUB_DATA_DIR}/files` fallback) and
+     * threaded through every route that touches sandbox dirs: the admin
+     * agents validator (seed existence check), `POST /sessions`
+     * (seed → sandbox copy), and `POST /admin/sessions/:id/purge-sandbox`.
+     *
+     * @see ../letta/sandbox.ts
+     * @see docs/server/session-sandboxes.md
+     */
+    filesDir: string;
+}
+/**
+ * The shape every route handler implements. Mirrors the Web-Standard fetch
+ * function signature plus the per-instance context bundle and the matched
+ * path parameters.
+ *
+ * `params` is keyed by the `:name` placeholders in the route template — e.g.
+ * `/admin/users/:id/role` yields `{ id: "abc" }`. Handlers that don't use
+ * params can simply omit the third argument (TypeScript bivariance allows it).
+ */
+export type RouteHandler = (req: Request, ctx: AIHubServerContext, params: Readonly<Record<string, string>>) => Promise<Response>;
+/** A path-aware handler entry consumed by the matcher. */
+export interface RouteEntry {
+    /** Uppercase HTTP method, or `"*"` to match any. */
+    method: string;
+    /**
+     * Path template with `:param` placeholders (e.g. `/sessions/:id`). Matched
+     * against the request path *after* the `basePath` prefix has been peeled.
+     */
+    path: string;
+    /** The handler. */
+    handler: RouteHandler;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/handlers/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/handlers/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,KAAK,QAAQ,MAAM,gBAAgB,CAAC;AAE3C,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AACrD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACtD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,gCAAgC,CAAC;AACzE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,4BAA4B,CAAC;AAEzD,iEAAiE;AACjE,MAAM,WAAW,kBAAkB;IACjC,6EAA6E;IAC7E,EAAE,EAAE,SAAS,CAAC;IACd,iFAAiF;IACjF,MAAM,EAAE,QAAQ,CAAC,QAAQ,CAAC;IAC1B,0CAA0C;IAC1C,MAAM,EAAE,MAAM,CAAC;IACf,iDAAiD;IACjD,aAAa,EAAE,MAAM,CAAC;IACtB;;;OAGG;IACH,QAAQ,EAAE,MAAM,CAAC;IACjB;;;;;OAKG;IACH,WAAW,EAAE,WAAW,CAAC;IACzB;;;;;;;;;;OAUG;IACH,kBAAkB,EAAE,kBAAkB,CAAC;IACvC;;;;;;;OAOG;IACH,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC;IAC9C;;;;;;;;;;OAUG;IACH,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED;;;;;;;;GAQG;AACH,MAAM,MAAM,YAAY,GAAG,CACzB,GAAG,EAAE,OAAO,EACZ,GAAG,EAAE,kBAAkB,EACvB,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,KACrC,OAAO,CAAC,QAAQ,CAAC,CAAC;AAEvB,0DAA0D;AAC1D,MAAM,WAAW,UAAU;IACzB,oDAAoD;IACpD,MAAM,EAAE,MAAM,CAAC;IACf;;;OAGG;IACH,IAAI,EAAE,MAAM,CAAC;IACb,mBAAmB;IACnB,OAAO,EAAE,YAAY,CAAC;CACvB"}

package/dist/handlers/types.js

@@ -0,0 +1,14 @@
+/**
+ * Shared types for the Fetch routing core.
+ *
+ * `AIHubServerContext` is the per-server-instance bundle: DB, logger, parsed
+ * encryption key, route prefix. Subsequent steps extend it (Letta client,
+ * mock-Letta toggle, etc.) — additions are additive.
+ *
+ * Handlers are Web-Standard `(Request, ctx) => Promise<Response>` per §6.2.
+ * No framework runtime, no plugin ecosystem.
+ *
+ * @see SPECIFICATIONS.md §6.2 — stack
+ */
+export {};
+//# sourceMappingURL=types.js.map

package/dist/handlers/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/handlers/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG"}