@desplega.ai/agent-swarm 1.129.0 → 1.131.0

package/src/http/assets.ts

@@ -1,5 +1,6 @@
 import type { IncomingMessage, ServerResponse } from "node:http";
 import { z } from "zod";
+import { getApp } from "../apps/store";
 import { auditAssetKeys } from "../be/asset-key-audit";
 import { AssetKeyAuthorizationError, authorizeAssetKeyWrite } from "../be/asset-key-auth";
 import { resolveHttpAuditUserId } from "../be/audit-user";
@@ -11,11 +12,41 @@ import {
   moveAssetKey,
   upsertAssetKeyMapping,
 } from "../be/db";
+import { getScriptById } from "../be/scripts/db";
 import { can, type RbacPrincipal, type RbacResource } from "../rbac";
-import { type AssetEntityType, AssetEntityTypeSchema, AssetKeySchema } from "../types";
+import {
+  type AssetEntityType,
+  AssetEntityTypeSchema,
+  AssetKeyMappingSchema,
+  AssetKeySchema,
+  AssetSummarySchema,
+} from "../types";
 import { getRequestAuth } from "../utils/request-auth-context";
 import { route } from "./route-def";
-import { json, jsonError } from "./utils";
+import { jsonError } from "./utils";
+
+const AssetKeyAuditIssueSchema = z.object({
+  severity: z.enum(["fatal", "warning"]),
+  code: z.enum([
+    "missing-key",
+    "noncanonical-key",
+    "unknown-personal-user",
+    "missing-provider-mapping",
+    "provider-mapping-drift",
+  ]),
+  entityType: AssetEntityTypeSchema,
+  entityId: z.string(),
+  message: z.string(),
+});
+
+const AssetKeyAuditResultSchema = z.object({
+  ok: z.boolean(),
+  structuralValid: z.boolean(),
+  checked: z.number().int().min(0),
+  fatalCount: z.number().int().min(0),
+  warningCount: z.number().int().min(0),
+  issues: z.array(AssetKeyAuditIssueSchema),
+});
 
 const keyAuditRoute = route({
   method: "get",
@@ -26,7 +57,7 @@ const keyAuditRoute = route({
     "Operator-only check for structural key validity, personal-user references, and logical provider mapping drift. Repeated logical keys are valid and are never reported as conflicts.",
   tags: ["Assets"],
   responses: {
-    200: { description: "Asset namespace audit result" },
+    200: { description: "Asset namespace audit result", schema: AssetKeyAuditResultSchema },
     403: { description: "Operator access required" },
   },
 });
@@ -41,11 +72,17 @@ const listAssetsRoute = route({
   tags: ["Assets"],
   query: z.object({
     keyPrefix: AssetKeySchema.optional(),
-    types: z.string().optional().describe("Comma-separated task,workflow,schedule,page,file list"),
+    types: z
+      .string()
+      .optional()
+      .describe("Comma-separated task,workflow,schedule,page,app,script,file list"),
     limit: z.coerce.number().int().min(1).max(1000).optional(),
   }),
   responses: {
-    200: { description: "Lightweight asset summary list" },
+    200: {
+      description: "Lightweight asset summary list",
+      schema: z.object({ assets: z.array(AssetSummarySchema), count: z.number().int() }),
+    },
     400: { description: "Invalid entity type" },
   },
 });
@@ -66,7 +103,7 @@ const registerMappingRoute = route({
     key: AssetKeySchema.optional(),
   }),
   responses: {
-    200: { description: "Mapping registered" },
+    200: { description: "Mapping registered", schema: AssetKeyMappingSchema },
     400: { description: "Invalid provider tuple or namespace" },
     403: { description: "Operator access required or personal namespace not authorized" },
   },
@@ -81,6 +118,46 @@ function ensureOperator(req: IncomingMessage, res: ServerResponse): boolean {
   return false;
 }
 
+const moveAssetBodySchema = z.object({ key: AssetKeySchema });
+const moveAssetSuccessSchema = z.object({
+  entityType: AssetEntityTypeSchema,
+  id: z.string(),
+  key: AssetKeySchema,
+});
+const moveAssetResponses = {
+  200: { description: "Asset namespace updated", schema: moveAssetSuccessSchema },
+  400: { description: "Invalid namespace" },
+  403: { description: "Move not authorized" },
+  404: { description: "Asset not found" },
+  409: { description: "Moves blocked until audit warnings are repaired" },
+} as const;
+
+// Register permission-specific paths before the polymorphic fallback so RBAC
+// admission can preserve each resource's mutation posture for scoped roles.
+const moveAppAssetRoute = route({
+  method: "patch",
+  path: "/api/assets/app/{id}/key",
+  pattern: ["api", "assets", "app", null, "key"],
+  summary: "Move an app to another logical namespace",
+  tags: ["Assets"],
+  params: z.object({ id: z.string().min(1) }),
+  body: moveAssetBodySchema,
+  responses: moveAssetResponses,
+  rbac: { permission: "app.manage" },
+});
+
+const moveScriptAssetRoute = route({
+  method: "patch",
+  path: "/api/assets/script/{id}/key",
+  pattern: ["api", "assets", "script", null, "key"],
+  summary: "Move a script to another logical namespace",
+  tags: ["Assets"],
+  params: z.object({ id: z.string().min(1) }),
+  body: moveAssetBodySchema,
+  responses: moveAssetResponses,
+  rbac: { permission: "script.global.write" },
+});
+
 const moveAssetRoute = route({
   method: "patch",
   path: "/api/assets/{entityType}/{id}/key",
@@ -90,20 +167,26 @@ const moveAssetRoute = route({
     "Updates namespace metadata only. Provider-backed files keep the same provider key, org, and drive; no remote move occurs. Personal keys are labels, not a privacy guarantee.",
   tags: ["Assets"],
   params: z.object({ entityType: AssetEntityTypeSchema, id: z.string().min(1) }),
-  body: z.object({ key: AssetKeySchema }),
-  responses: {
-    200: { description: "Asset namespace updated" },
-    400: { description: "Invalid namespace" },
-    403: { description: "Move not authorized" },
-    404: { description: "Asset not found" },
-    409: { description: "Moves blocked until audit warnings are repaired" },
-  },
+  body: moveAssetBodySchema,
+  responses: moveAssetResponses,
   rbac: {
     ungated:
-      "preserves each entity's current mutation posture; task moves additionally use task.fs.mutate, file moves require operator authentication, and personal destinations require a matching trusted user",
+      "preserves each entity's current mutation posture; task moves use task.fs.mutate, app moves use app.manage, scripts preserve agent ownership/global-lead rules, file moves require operator authentication, and personal destinations require a matching trusted user",
   },
 });
 
+function assetMovePrincipal(
+  req: IncomingMessage,
+  myAgentId: string | undefined,
+): RbacPrincipal | null {
+  const auth = getRequestAuth(req);
+  if (auth?.kind === "operator") return { kind: "operator" };
+  if (auth?.kind === "user") return { kind: "user", userId: auth.userId };
+  if (!myAgentId) return null;
+  const agent = getAgentById(myAgentId);
+  return { kind: "agent", agentId: myAgentId, isLead: agent?.isLead ?? false };
+}
+
 function canMutateTaskNamespace(
   task: { id: string; agentId: string | null; creatorAgentId?: string },
   myAgentId: string | undefined,
@@ -115,20 +198,42 @@ function canMutateTaskNamespace(
     agentId: task.agentId,
     creatorAgentId: task.creatorAgentId,
   };
-  const auth = getRequestAuth(req);
-  let principal: RbacPrincipal;
-  if (auth?.kind === "operator") {
-    principal = { kind: "operator" };
-  } else if (auth?.kind === "user") {
-    principal = { kind: "user", userId: auth.userId };
-  } else {
-    if (!myAgentId) return false;
-    const agent = getAgentById(myAgentId);
-    principal = { kind: "agent", agentId: myAgentId, isLead: agent?.isLead ?? false };
-  }
+  const principal = assetMovePrincipal(req, myAgentId);
+  if (!principal) return false;
   return can({ principal, verb: "task.fs.mutate", resource, source: "http" }).allow;
 }
 
+function canManageAppNamespace(
+  id: string,
+  req: IncomingMessage,
+  myAgentId: string | undefined,
+): boolean {
+  const principal = assetMovePrincipal(req, myAgentId);
+  return (
+    !!principal &&
+    can({ principal, verb: "app.manage", resource: { kind: "app", appId: id }, source: "http" })
+      .allow
+  );
+}
+
+function canManageScriptNamespace(
+  script: NonNullable<ReturnType<typeof getScriptById>>,
+  req: IncomingMessage,
+  myAgentId: string | undefined,
+): boolean {
+  const principal = assetMovePrincipal(req, myAgentId);
+  if (!principal) return false;
+  if (principal.kind === "operator") return true;
+  if (principal.kind !== "agent") return false;
+  if (script.scope === "agent") return script.scopeId === principal.agentId;
+  return can({
+    principal,
+    verb: "script.global.write",
+    resource: { kind: "owned", scope: "global" },
+    source: "http",
+  }).allow;
+}
+
 export async function handleAssets(
   req: IncomingMessage,
   res: ServerResponse,
@@ -140,7 +245,7 @@ export async function handleAssets(
     const parsed = await keyAuditRoute.parse(req, res, pathSegments, queryParams);
     if (!parsed) return true;
     if (!ensureOperator(req, res)) return true;
-    json(res, auditAssetKeys(getDb()));
+    keyAuditRoute.respond(res, 200, auditAssetKeys(getDb()));
     return true;
   }
 
@@ -162,7 +267,7 @@ export async function handleAssets(
       types: types.length > 0 ? types : undefined,
       limit: parsed.query.limit,
     });
-    json(res, { assets, count: assets.length });
+    listAssetsRoute.respond(res, 200, { assets, count: assets.length });
     return true;
   }
 
@@ -182,7 +287,7 @@ export async function handleAssets(
         createdBy: actor ?? undefined,
         updatedBy: actor ?? undefined,
       });
-      json(res, mapping);
+      registerMappingRoute.respond(res, 200, mapping);
     } catch (error) {
       if (error instanceof AssetKeyAuthorizationError) {
         jsonError(res, error.message, error.statusCode);
@@ -193,7 +298,11 @@ export async function handleAssets(
     return true;
   }
 
-  if (moveAssetRoute.match(req.method, pathSegments)) {
+  if (
+    moveAppAssetRoute.match(req.method, pathSegments) ||
+    moveScriptAssetRoute.match(req.method, pathSegments) ||
+    moveAssetRoute.match(req.method, pathSegments)
+  ) {
     const parsed = await moveAssetRoute.parse(req, res, pathSegments, queryParams);
     if (!parsed) return true;
     if (parsed.params.entityType === "file" && !ensureOperator(req, res)) return true;
@@ -208,6 +317,27 @@ export async function handleAssets(
         return true;
       }
     }
+    if (parsed.params.entityType === "app") {
+      if (!getApp(parsed.params.id)) {
+        jsonError(res, "Asset not found", 404);
+        return true;
+      }
+      if (!canManageAppNamespace(parsed.params.id, req, myAgentId)) {
+        jsonError(res, "Not authorized to move this app namespace", 403);
+        return true;
+      }
+    }
+    if (parsed.params.entityType === "script") {
+      const script = getScriptById(parsed.params.id);
+      if (!script) {
+        jsonError(res, "Asset not found", 404);
+        return true;
+      }
+      if (!canManageScriptNamespace(script, req, myAgentId)) {
+        jsonError(res, "Not authorized to move this script namespace", 403);
+        return true;
+      }
+    }
 
     try {
       const actor = resolveHttpAuditUserId(req, myAgentId);
@@ -222,7 +352,11 @@ export async function handleAssets(
         jsonError(res, "Asset not found", 404);
         return true;
       }
-      json(res, { entityType: parsed.params.entityType, id: parsed.params.id, key });
+      moveAssetRoute.respond(res, 200, {
+        entityType: parsed.params.entityType,
+        id: parsed.params.id,
+        key,
+      });
     } catch (error) {
       if (error instanceof AssetKeyAuthorizationError) {
         jsonError(res, error.message, error.statusCode);

package/src/http/budgets.ts

@@ -20,7 +20,7 @@ import {
 import { BudgetRefusalNotificationSchema, BudgetSchema, BudgetScopeSchema } from "../types";
 import { scrubSecrets } from "../utils/secret-scrubber";
 import { route } from "./route-def";
-import { json, jsonError } from "./utils";
+import { jsonError } from "./utils";
 
 // ─── Helpers ─────────────────────────────────────────────────────────────────
 
@@ -128,7 +128,7 @@ export async function handleBudgets(
   if (listBudgets.match(req.method, pathSegments)) {
     const parsed = await listBudgets.parse(req, res, pathSegments, queryParams);
     if (!parsed) return true;
-    json(res, { budgets: getBudgets() });
+    listBudgets.respond(res, 200, { budgets: getBudgets() });
     return true;
   }
 
@@ -139,7 +139,9 @@ export async function handleBudgets(
     const parsed = await listBudgetRefusals.parse(req, res, pathSegments, queryParams);
     if (!parsed) return true;
     const limit = parsed.query.limit ?? 50;
-    json(res, { refusals: getRecentBudgetRefusalNotifications(limit) });
+    listBudgetRefusals.respond(res, 200, {
+      refusals: getRecentBudgetRefusalNotifications(limit),
+    });
     return true;
   }
 
@@ -161,7 +163,7 @@ export async function handleBudgets(
       jsonError(res, "Budget not configured", 404);
       return true;
     }
-    json(res, row);
+    getBudgetByScope.respond(res, 200, row);
     return true;
   }
 
@@ -184,7 +186,7 @@ export async function handleBudgets(
       },
     });
 
-    json(res, updated);
+    upsertBudgetRoute.respond(res, 200, updated);
     return true;
   }
 

package/src/http/codex-oauth-keep-warm.ts

@@ -23,12 +23,13 @@
  */
 
 import type { IncomingMessage, ServerResponse } from "node:http";
+import { z } from "zod";
 import { getKv } from "../be/db";
 import { deriveCodexKeySuffix } from "../providers/codex-oauth/auth-json.js";
 import { getValidCodexOAuth, loadAllCodexOAuthSlots } from "../providers/codex-oauth/storage.js";
 import { getApiKey } from "../utils/api-key";
 import { route } from "./route-def";
-import { deriveApiBaseUrl, json } from "./utils";
+import { deriveApiBaseUrl } from "./utils";
 
 /** ~weekly refresh cadence, comfortably inside OpenAI's ~8-day staleness window given the 10-day TTL. */
 const KEEP_WARM_MAX_AGE_MS = 7 * 24 * 60 * 60 * 1000;
@@ -42,6 +43,20 @@ type SlotOutcome =
   | { slot: number; outcome: "no-credentials" }
   | { slot: number; keySuffix: string; outcome: "failed"; reason: string };
 
+/** Mirrors the `SlotOutcome` union above — split so each branch has a single discriminant literal. */
+const slotOutcomeSchema = z.discriminatedUnion("outcome", [
+  z.object({ slot: z.number(), keySuffix: z.string(), outcome: z.literal("warm") }),
+  z.object({ slot: z.number(), keySuffix: z.string(), outcome: z.literal("refreshed") }),
+  z.object({ slot: z.number(), keySuffix: z.string(), outcome: z.literal("skipped-benched") }),
+  z.object({ slot: z.number(), outcome: z.literal("no-credentials") }),
+  z.object({
+    slot: z.number(),
+    keySuffix: z.string(),
+    outcome: z.literal("failed"),
+    reason: z.string(),
+  }),
+]);
+
 const keepWarmRoute = route({
   method: "post",
   path: "/api/oauth/keep-warm/codex",
@@ -51,7 +66,10 @@ const keepWarmRoute = route({
     "Enumerates codex_oauth_* slots and refreshes any older than ~7 days through the same locked getValidCodexOAuth path used at task time. Skips slots already benched by codex-auth-expiry-watch.",
   tags: ["OAuth"],
   responses: {
-    200: { description: "Per-slot keep-warm outcomes" },
+    200: {
+      description: "Per-slot keep-warm outcomes",
+      schema: z.object({ results: z.array(slotOutcomeSchema) }),
+    },
   },
 });
 
@@ -102,6 +120,6 @@ export async function handleCodexOAuthKeepWarm(
     await new Promise((resolve) => setTimeout(resolve, 100 + Math.random() * 200));
   }
 
-  json(res, { results });
+  keepWarmRoute.respond(res, 200, { results });
   return true;
 }

package/src/http/config.ts

@@ -17,11 +17,12 @@ import {
   validateConfigValue,
 } from "../be/swarm-config-guard";
 import { can, isRbacEnabled, type PermissionVerb } from "../rbac";
+import { SwarmConfigSchema } from "../types";
 import { getRequestAuth } from "../utils/request-auth-context";
 import { registerVolatileSecret } from "../utils/secret-scrubber";
 import { reloadGlobalConfigsAndIntegrations, scheduleIntegrationsReload } from "./core";
 import { route } from "./route-def";
-import { json, jsonError } from "./utils";
+import { jsonError } from "./utils";
 
 const MAX_ENV_PRESENCE_KEYS = 200;
 const SECRETS_FORCE_MASK_NOTE =
@@ -119,7 +120,13 @@ const getResolvedConfigRoute = route({
     includeSecrets: z.enum(["true", "false"]).optional(),
   }),
   responses: {
-    200: { description: "Resolved config entries" },
+    200: {
+      description: "Resolved config entries",
+      schema: z.object({
+        configs: z.array(SwarmConfigSchema),
+        message: z.string().optional(),
+      }),
+    },
   },
 });
 
@@ -134,7 +141,10 @@ const envPresence = route({
     keys: z.string().min(1),
   }),
   responses: {
-    200: { description: "Map of key -> boolean (true iff set in process.env)" },
+    200: {
+      description: "Map of key -> boolean (true iff set in process.env)",
+      schema: z.object({ presence: z.record(z.string(), z.boolean()) }),
+    },
     400: { description: "Validation error" },
   },
 });
@@ -148,7 +158,15 @@ const reloadConfigRoute = route({
   tags: ["Config"],
   body: z.object({}).optional(),
   responses: {
-    200: { description: "Reload result" },
+    200: {
+      description: "Reload result",
+      schema: z.object({
+        success: z.literal(true),
+        configsLoaded: z.number(),
+        keysUpdated: z.array(z.string()),
+        integrationsReinitialized: z.array(z.string()),
+      }),
+    },
     500: { description: "Reload failed" },
   },
 });
@@ -164,7 +182,10 @@ const getConfigById = route({
     includeSecrets: z.enum(["true", "false"]).optional(),
   }),
   responses: {
-    200: { description: "Config entry" },
+    200: {
+      description: "Config entry",
+      schema: SwarmConfigSchema.extend({ message: z.string().optional() }),
+    },
     404: { description: "Config not found" },
   },
 });
@@ -181,7 +202,13 @@ const listConfig = route({
     includeSecrets: z.enum(["true", "false"]).optional(),
   }),
   responses: {
-    200: { description: "List of config entries" },
+    200: {
+      description: "List of config entries",
+      schema: z.object({
+        configs: z.array(SwarmConfigSchema),
+        message: z.string().optional(),
+      }),
+    },
   },
 });
 
@@ -203,7 +230,7 @@ const upsertConfig = route({
     description: z.string().nullish(),
   }),
   responses: {
-    200: { description: "Config entry upserted" },
+    200: { description: "Config entry upserted", schema: SwarmConfigSchema },
     400: { description: "Validation error" },
   },
 });
@@ -218,7 +245,10 @@ const deleteConfig = route({
   rbac: { permission: "config.delete.any" },
   params: z.object({ id: z.string() }),
   responses: {
-    200: { description: "Config deleted" },
+    200: {
+      description: "Config deleted",
+      schema: z.object({ success: z.literal(true) }),
+    },
     404: { description: "Config not found" },
   },
 });
@@ -247,7 +277,7 @@ export async function handleConfig(
         }
       }
     }
-    json(res, {
+    getResolvedConfigRoute.respond(res, 200, {
       configs: result,
       ...(secretsNote ? { message: `Found ${result.length} config(s).${secretsNote}` } : {}),
     });
@@ -269,7 +299,7 @@ export async function handleConfig(
     for (const key of keys) {
       presence[key] = process.env[key] !== undefined && process.env[key] !== "";
     }
-    json(res, { presence });
+    envPresence.respond(res, 200, { presence });
     return true;
   }
 
@@ -279,7 +309,7 @@ export async function handleConfig(
       console.log(
         `[reload-config] Loaded ${result.configsLoaded} config(s), re-initialized: ${result.integrationsReinitialized.join(", ") || "none"}`,
       );
-      json(res, { success: true, ...result });
+      reloadConfigRoute.respond(res, 200, { success: true, ...result });
     } catch (e) {
       const message = e instanceof Error ? e.message : String(e);
       console.error("[reload-config] Failed:", message);
@@ -302,7 +332,7 @@ export async function handleConfig(
     if (effectiveIncludeSecrets && singleResult.isSecret && singleResult.value) {
       registerVolatileSecret(singleResult.value, `config:${singleResult.key}`);
     }
-    json(res, {
+    getConfigById.respond(res, 200, {
       ...singleResult,
       ...(secretsNote ? { message: `Found 1 config(s).${secretsNote}` } : {}),
     });
@@ -328,7 +358,7 @@ export async function handleConfig(
         }
       }
     }
-    json(res, {
+    listConfig.respond(res, 200, {
       configs: listResult,
       ...(secretsNote ? { message: `Found ${listResult.length} config(s).${secretsNote}` } : {}),
     });
@@ -380,8 +410,8 @@ export async function handleConfig(
       if (scope === "global") {
         scheduleIntegrationsReload();
       }
-      const result = includeSecrets || !config.isSecret ? config : maskSecrets([config])[0];
-      json(res, result);
+      const result = includeSecrets || !config.isSecret ? config : maskSecrets([config])[0]!;
+      upsertConfig.respond(res, 200, result);
     } catch (_error) {
       jsonError(res, "Failed to upsert config", 500);
     }
@@ -405,7 +435,7 @@ export async function handleConfig(
     if (existing.scope === "global") {
       scheduleIntegrationsReload();
     }
-    json(res, { success: true });
+    deleteConfig.respond(res, 200, { success: true });
     return true;
   }
 

package/src/http/context.ts

@@ -6,9 +6,36 @@ import {
   getContextSummaryByTaskId,
   getTaskById,
 } from "../be/db";
-import { ContextFormulaSchema, ContextSnapshotEventTypeSchema } from "../types";
+import {
+  ContextFormulaSchema,
+  ContextSnapshotEventTypeSchema,
+  ContextSnapshotSchema,
+} from "../types";
 import { route } from "./route-def";
-import { json, jsonError } from "./utils";
+import { jsonError } from "./utils";
+
+// ─── Response Schemas ───────────────────────────────────────────────────────
+
+const PostContextResponseSchema = z.object({
+  ok: z.literal(true),
+  snapshotId: z.uuid(),
+});
+
+// Mirrors the `ContextSummary` interface returned by
+// `getContextSummaryByTaskId` in src/be/db.ts — not a named entity schema in
+// types.ts, so defined locally.
+const ContextSummarySchema = z.object({
+  compactionCount: z.number().int().min(0),
+  peakContextPercent: z.number().min(0).max(100).nullable(),
+  peakContextTokens: z.number().int().min(0).nullable(),
+  contextWindowSize: z.number().int().min(0).nullable(),
+  snapshotCount: z.number().int().min(0),
+});
+
+const GetContextResponseSchema = z.object({
+  snapshots: z.array(ContextSnapshotSchema),
+  summary: ContextSummarySchema,
+});
 
 // ─── Route Definitions ───────────────────────────────────────────────────────
 
@@ -34,7 +61,7 @@ const postContext = route({
     contextFormula: ContextFormulaSchema.optional(),
   }),
   responses: {
-    200: { description: "Snapshot recorded" },
+    200: { description: "Snapshot recorded", schema: PostContextResponseSchema },
     400: { description: "Validation error" },
     404: { description: "Task not found" },
   },
@@ -52,7 +79,7 @@ const getContext = route({
     limit: z.coerce.number().int().min(1).max(500).default(100),
   }),
   responses: {
-    200: { description: "Context snapshot history" },
+    200: { description: "Context snapshot history", schema: GetContextResponseSchema },
     404: { description: "Task not found" },
   },
   auth: { apiKey: true },
@@ -97,7 +124,7 @@ export async function handleContext(
       contextFormula: parsed.body.contextFormula,
     });
 
-    json(res, { ok: true, snapshotId: snapshot.id });
+    postContext.respond(res, 200, { ok: true, snapshotId: snapshot.id });
     return true;
   }
 
@@ -114,7 +141,7 @@ export async function handleContext(
     const snapshots = getContextSnapshotsByTaskId(parsed.params.id, parsed.query.limit);
     const summary = getContextSummaryByTaskId(parsed.params.id);
 
-    json(res, { snapshots, summary });
+    getContext.respond(res, 200, { snapshots, summary });
     return true;
   }